# Switches & VLAN Segmentation

## Managed Switches

### MikroTik (best value, steepest learning curve)
- CRS326-24G-2S+RM: 24 GbE + 2 SFP+ for ~$200
- RouterOS: unlimited VLAN power, CLI-driven
- Guide: https://mikroradius.com/blog/how-to-configure-vlans-on-mikrotik-router-network-segmentation-made-easy

### Ubiquiti UniFi (best UI, ecosystem lock-in)
- USW-Pro-24-PoE integrates with UniFi controller
- Easy VLAN setup but less flexible than MikroTik

### Cisco Catalyst (enterprise standard)
- Catalyst 1000 series for lab use
- Full IOS CLI, real-world experience
- Most expensive

Comparison: https://www.fccj.org/best-managed-network-switches-for-home-labs/

## Recommended VLAN Architecture

| VLAN | Purpose | Notes |
|------|---------|-------|
| 1 | Management | Switch/AP/firewall admin interfaces ONLY |
| 10 | Trusted LAN | Workstations |
| 20 | Servers/Lab | STARGATE, services |
| 30 | IoT | No internet except specific endpoints |
| 40 | Guest | Internet only, no local access |
| 50 | DMZ | Public-facing services |
| 60 | Plan 9 | Cluster isolation (see plan9-security/) |

Inter-VLAN routing through OPNsense with strict ACLs.

Guide: https://mattadam.com/2025/09/17/how-to-use-vlans-and-subnets-in-home-lab-environments-without-losing-your-mind/

## Network TAPs vs SPAN Ports

TAPs are superior for security monitoring:
- Passive, no latency, no performance impact
- Capture 100% of traffic including errors
- No IP address, can't be hacked
- Work even under high switch utilization

SPAN: cheaper, just a config change, but drops packets under load.

Vendors:
- Garland Technology: purpose-built, ~$200+ for copper
- Profitap: mid-range
- Dualcomm: budget, ~$50-80 on Amazon

References:
- https://www.garlandtechnology.com/tap-vs-span
- https://insights.profitap.com/tap-vs-span