A VLAN plan is four to six lines that take ten minutes to write and last for years. The work is not in inventing it but in not going too far: every extra VLAN costs a subnet, a DHCP server, firewall rules and a tag on every trunk.
What earns a VLAN of its own
A network earns its own VLAN when you want to treat it differently from the rest. Differently means: other firewall rules, other internet access, or it may go down without anybody else noticing.
- Guests. Equipment you do not manage, with no business near your files.
- IoT, cameras and printers. Devices that go years without an update, some of which need no internet at all.
- Management. The network your switches and access points are reachable on.
- VoIP, when the phones have their own priority or their own provider.
What usually does not earn one: a VLAN per department, per floor or per printer. Sales and purchasing need the same rules, so they belong on the same network; keeping them apart is a matter of permissions on the server, not of a tag. Floors are a cabling question. And do not add a VLAN you might use later: an empty VLAN is a tag you carry everywhere for nothing.
Numbering that stays readable
Count in tens: 10, 20, 30, 40. Something can then always be fitted in between without moving everything, and the numbers stay short enough to remember. Keep one high number aside for management, 99 for instance, which reads at a glance as "this is not a user network".
Let the third octet of the address match the VLAN number. VLAN 20 becomes 192.168.20.0/24, VLAN 30 becomes 192.168.30.0/24. You can then see from any address which network it is on, which helps when reading a firewall rule or a DHCP lease. The configurator already works this way: a new VLAN row gets the next number plus ten and the address 192.168.<number>.1/24. Above 254 that trick runs out, which is one more reason to keep your numbers low.
VLAN 1 is not available: it is the bridge's own pvid, and the tool raises an error on it. If you want an untagged network on the bridge itself, set the port's untagged VLAN to "bridge" instead of defining a VLAN with id 1. See VLANs for what each field does.
The management VLAN
Mark one VLAN in the table as management. That is the network your switches and access points are reachable on, and the tool uses the mark:
- Devices that do not route get a fixed address in that subnet, counted up from the router address, with the router as their gateway. Without the mark every switch keeps the role's default address, so they all end up on the same one.
- The VLAN interface gets the comment
managementin the script, so you find it back in/interface vlan print. - If a device does not carry the management VLAN, that is an error in the site checks: after pasting, that device cannot be reached any more.
Management belongs tagged towards your switches and access points, never untagged on a desk port. Give the management network room as well: a /24 is fine, a /30 is not.
Where isolation belongs
Each VLAN row has two switches worth a deliberate choice. Isolated means the network may not reach the other networks, which is what guests and IoT want. Internet can be turned off for cameras that only need to talk on the inside. Leave the main network alone: that is exactly where you want to reach the printer and the server.
The first VLAN in the table is what wired ports get by default. Put an isolated guest network at the top and every desk port lands on the guest network. That looks like a working configuration and is not one. The tool reports it as an error, but it is nicer to put the main network at the top in the first place.
For finer control over who may reach whom, the firewall takes a matrix with a tick per pair of networks. That matrix ends up on the handover sheet too.
How the plan lands in the tool
In multiple devices you fill in the VLAN table once, under the shared settings. That table goes to every device in the site, so a tag means the same network everywhere. Only the router gets the addresses and the DHCP servers with it; a switch or access point gets the same table to tag with, without an address and without DHCP, because two devices answering for the same address is a broken network. Per device you can narrow the list to the VLANs that actually pass through there.
Which ports become trunks follows from the cables you draw on the network board. A trunk tags every VLAN and carries nothing untagged. After that the tool checks your plan across the whole site: a VLAN a device uses that is not in the site table is an error, a VLAN known at one end of a cable and not at the other stops there, and an SSID on a VLAN that access point does not carry raises a warning.
With several locations, read planning your addresses too: one VLAN plan serves them all as long as each has its own address range.