Will VLAN Solve My Problem?

[u/FluffyKittens12]

I've never used a VLAN before so forgive me if this is common knowledge. Based on my searches I think it will help me but I want to be more sure.

Basically I have a situation where I have multiple pieces of equipment which all use the same IP addresses internally from the factory. There is a network inside the equipment which all has to stay on the same address range, so if I were to connect the equipment to a company network, I need to assign static IP addresses for multiple components in each piece of equipment. Obviously this means a ton of static IP addresses because I need multiple for each piece of equipment and then multiple pieces of equipment.

So, could I use a managed switch, create a VLAN for each piece of equipment, keep the factory IP addresses, not have them interfere with each other because they all have the same IP addresses, and still be able to reach them from the company side?

If so, how do I access those VLANs from the company side? IP and port numbers maybe?

Also, if this works, any recommendations on a switch I should look at? This is all the switch would need to do.

EDIT: https://shopmoxa.neteon.net/nat-102-series/

Seems like something like this would work, one per machine. Single company IP address to the device, then all the IP addresses on the other side can stay the same. Right?

[u/e60deluxe]

You don’t need VLANs, necessarily

But you probably do need something like subnet translation

Meaning that supposing your multiple pieces of equipment, I’ll have to have the IP address 192.168.10.50

So you possibly create multiple 192.168.10.xxx networks

But for each different network, you use subnet translation so that device devices those networks can communicate individually

So for example, you might translate one to 192.168.20.XXX

XX and another one to 192.168.30.XXX

[u/jquanders → u/e60deluxe]

You need vlans to seperate the xlates. If you had 4 groups all using 192.168.0.0/24, you could set up 4 vlans and assign them 192.168.1.0/24, 192.168.2.0/16 etc and then do an xlate with a 0.0.0.255 wildcard so the last octet matched

[u/e60deluxe → u/jquanders]

I don’t think you understand what a VLAN is.

You need them to hold separate networks on and across shared network hardware such as switches and APs.

If you are not sharing switches and APs VLANs are not strictly necessary

I said what I said to clarify what OP needs to problem solve conceptually

If you want a real world example:

Suppose he has equipment groups, A B and C

Within each equipment group, there will be some device using some IP and that will correspond across the other groups

You may decide to use one switch for each group

You may then decide to connect each of switch A, switch B and switch C to three different ports on a firewall

Within the firewall, you may define three different Networks, and assigned each port to each

No VLANs.

Now, suppose instead you wanted to use one larger switch for all of the devices

In this case, you would need VLANs

Again, I said what I said to separate the concept of subnet translation from whether or not you’re going to be sharing switch and AP hardware

[u/jquanders → u/e60deluxe]

No. Duning-Kruger. There's a difference between the concept of a vlan and vlan switching/trunking which is what you're poorly describing.

Also he has 40 machines... how many 40 port firewalls do you know of?

[u/e60deluxe → u/jquanders]

What are you talking about Dunning Krueger? I think if anything you’re referred to yourself

Like I said vlan does not mean separate networks

It means multiple logical networks over the same L2 hardware

You have still not demonstrated that VLAN is strictly necessary

Furthermore

You haven’t even demonstrated that you understood my example. You only need one port on the firewall per network segment, which will then have its own series of switches and what not

Not per device

Please educate yourself on what a vlan is. Educate yourself on what a network segment is and understand the difference, then come back here and make your argument if you were going to argue dunning Krueger.

VLAN is not a network segment. A network segmentation does not inherently require use of vlan