Hi again,
unfortunately you didn't tell how your three networks will map to VLANs, so part of your questions cannot be answered unambiguously.
In fact you have a fourth network in place, namely the management network 10.0.0.0/8 which is bound to VLAN 1 in any of the two DGS switches, where both of them (according to the
manual, page 16) have a default address of 10.90.90.90. Hence if you connect both switches, you will have an address collision, because both switches claim to have the same IP address. Hence, if you won't indeed change the management network 10.0.0.0/8, you have to change the management address of at least one switch to an address different from the management address of the other switch (e.g. 10.90.90.91).
You have to decide, how you want to access your switches for switch management. You have several choices:
- You could decide to reserve VLAN 1 and the associated management network 10.0.0.0/8 for management purposes only, that is for all other purposes, such as your 3 networks 192.168.x.0/24 {x = 1, 2, 3}, you would configure VLANs different from VLAN 1. The drawback of that decision is, that you don't have management access to the switches from any of your network nodes, because they live in different networks/VLANs (unless some existent router, that is connected to all VLANs, allows routing between say the network/VLAN used for "Official Desktops" and the management network/VLAN1). If you leave VLAN 1 unaccessable via routing and even physically disconnected, you would have to reserve at least one switch port per switch configured to be an access port for VLAN 1 for management purposes, where you connect a management PC only if needed to change the switch configuration. In this case the management PC must be configured to have an address out of 10.0.0.0/8 different from the switch's management IP address. In this case you can even leave any switch using the same default address 10.90.90.90 because they don't see each other.
- Same as the last bullet, but you decide to connect all switches to bridge VLAN 1 (either via access ports configured for VLAN 1 or via VLAN trunk ports, where VLAN 1 is part of several VLANs) to a router, which allows routing access to the management network from some other network (e.g. the network containing the "Official Desktops"). In this case you have to ensure that the management addresses of the switches are unique. And you have to change the default gateway within each switch to point to the router's IP address within VLAN 1. Of course using 10.0.0.0/8 as a management network is a quite unreasonnable default selection by D-Link, because it prevents the use of this huge private address space for purposes other than the switch management network. Hence, I would lengthen the prefix length from /8 to say /24, so that the management network now is of size C-class = 10.90.90.0/24.
- You can choose to share VLAN 1 for switch management and use via your "Official Desktops". This gives you the advantage, that your switches can be directly managed from every "Official Desktop" without routing. The drawback is, that you have to ensure, that both the "Offical Desktops" and the switches use the same IP network, which either forces the "Offical Desktops" to use addresses from the predefined management network 10.0.0.0/8 or the switches to be renumbered to use management addresses from 192.168.1.0/24. I would prefer the second choice!
- You could also decice to use VLAN 1 for no purpose other than a dummy VLAN (e.g. as a "native" VLAN of a VLAN trunk port, where only tagged frames are expected to be received and hence the native VLAN is a "dummy data sink to nowhere". In this case you would assign the switches' management interfaces to another VLAN, see section "VLAN > 802.1Q Management VLAN" at page 37 of the manual.)
Hence, the answer to your first question depends on your choice, of how you want to handle this.
I'm not sure what you mean when you ask "Do I need to configure a LAG group or is one port enough for the trunking" in question 2 - maybe, there is a misunderstanding because the term "trunking" is overloaded to mean both a Link aggragation group (LAG) of at least two physical links/ports used to increase bandwidth (Cisco calls this a "portchannel") and a "VLAN trunk", which means, that you use a physical link (which itself can be a LAG or a single physical link) to transmit ethernet frames that belong to several VLANs (which means frames must be tagged except at most one, which is the "native" VLAN).
The answer to your third question results in what features your Cisco router provides to allow internet access for any of your 3 networks on the one hand, but block communication between the "Guest" network and any of the two other networks on the other hand. Assuming a Cisco IOS, this could be managed via Access Control Lists (ACL) inside your router configuration.
Given the scenario depicted in your last post, in any case you would have to configure "VLAN trunk" ports for the AP connections (respective ports are "tagged" members for the two VLANs used for the "Official wireless" and "Guest" devices) and VLAN tunk ports for the RT-SW1 and SW1-SW2 "Uplink"-connections (for all VLANs in use, eventually including a dedicated management vlan for routing purposes according to the discussion above), where the Uplink connections could consist of LAGs or single physical links as a matter of choice (given the Cisco router has several LAN ports to be bundled to a portchannel).
PT
