Newbie Network upgrades with Firewalla
I want to secure my home network, and have a Firewalla Gold Plus on the way and the Switch SE ordered. I currently use 4 TP-Link Deco 7 Pro BE17000 as router/MESH. Two of the Decos are hardwired for backhaul through an unmanaged switch. I have several wifi security cameras and other IoT devices that I want to segregate from the rest of my internal network. My first plan was to manage the Decos with the Firewalla Gold/Switch combo, using different wifi channels for each VLAN. Is this viable, or did I miss a step that would be filled or improved by replacing the Decos with Firewall AP7s?
Thanks in advance for any thoughts.
-
Hi Ian, just to double-check, are these TP-Link Decos VLAN-aware? If so, then yes, it should work just fine as long as you configure the VLANs in Firewalla to match the VLANs set up in the Deco, and the Switch ports are set up as Trunk (carries multiple VLANs). You may also need to ensure your Decos can run in AP mode / Bridge mode.
The AP7s are great if you need that extra granular control over your Wi-Fi devices. Without it, you'll still be able to segment devices between VLANs, but Wi-Fi devices within each VLAN may still be able to communicate.
-
I don't think my Decos can do VLAN, that would have to be handled by the Gold Plus and the Switch SE. My starting point would be to set up 4 VLANs: Trusted (my computers and NAS), IoT, Cameras (Reolink floodlights + doorbell) and Guest. I think at least to start this would be possible with the Firewalla Gold+Switch. What could I gain by incorporating AP7s instead of the Decos?
-
Your APs will need to support 802.1Q VLANs to properly create separate Wi-Fi SSIDs on different networks. While I'm unfamiliar with the specifics of the Deco system, if they are not VLAN-aware, they may need to be all on the same single VLAN. With your current setup, you could try to:
- Set up Wi-Fi devices with your Decos on one VLAN.
- Set up Ethernet devices with the Switch on other VLANs.
This way, you can still segment your network slightly. This is a good example: Tutorial: VLAN-Based Segmentation (Gold, Purple, & Orange)
The Firewalla AP7s do support 802.1Q VLANs, so you wouldn't be limited to only one VLAN for all Wi-Fi devices. In fact, with AP7, you could even segment your network with VqLAN, and avoid the complexities of VLANs altogether while still getting the same benefits of dividing your network into pieces.
-
Coverage really depends on the shape and material of your location, as well as your speed requirements. But we typically recommend the same number of AP7s as your current mesh units (direct 1-to-1 replacement). Depending on where you're able to place your units, you may need more or less: https://help.firewalla.com/hc/en-us/community/posts/36934249691539-Firewalla-AP7-Coverage
Please sign in to leave a comment.
Comments
5 comments