#Switches & VLAN Segmentation

#Managed Switches

#MikroTik (best value, steepest learning curve)

• CRS326-24G-2S+RM: 24 GbE + 2 SFP+ for ~$200
• RouterOS: unlimited VLAN power, CLI-driven
• Guide: https://mikroradius.com/blog/how-to-configure-vlans-on-mikrotik-router-network-segmentation-made-easy

#Ubiquiti UniFi (best UI, ecosystem lock-in)

• USW-Pro-24-PoE integrates with UniFi controller
• Easy VLAN setup but less flexible than MikroTik

#Cisco Catalyst (enterprise standard)

• Catalyst 1000 series for lab use
• Full IOS CLI, real-world experience
• Most expensive

Comparison: https://www.fccj.org/best-managed-network-switches-for-home-labs/

#Recommended VLAN Architecture

Inter-VLAN routing through OPNsense with strict ACLs.

Guide: https://mattadam.com/2025/09/17/how-to-use-vlans-and-subnets-in-home-lab-environments-without-losing-your-mind/

#Network TAPs vs SPAN Ports

TAPs are superior for security monitoring:

• Passive, no latency, no performance impact
• Capture 100% of traffic including errors
• No IP address, can't be hacked
• Work even under high switch utilization

SPAN: cheaper, just a config change, but drops packets under load.

Vendors:

• Garland Technology: purpose-built, ~$200+ for copper
• Profitap: mid-range
• Dualcomm: budget, ~$50-80 on Amazon

References:

• https://www.garlandtechnology.com/tap-vs-span
• https://insights.profitap.com/tap-vs-span