================================================================
SD Tech Solutions — Managed Switch: Base VLAN Template  (v1.0)
================================================================
Generic template for a small-business managed switch. Syntax shown
is Cisco-IOS-style; the structure maps 1:1 onto Netgear/TP-Link/
UniFi/Aruba web UIs. Replace ALL <PLACEHOLDER> values before use.

DESIGN (3-VLAN baseline)
  VLAN 10  DATA    — workstations, printers
  VLAN 20  VOICE   — phones (if applicable)
  VLAN 30  GUEST   — internet-only, isolated from DATA
  VLAN 99  MGMT    — switch/AP/firewall management ONLY
  VLAN 1   — unused. Never carry traffic on VLAN 1.

----------------------------------------------------------------
! -- VLAN definitions
vlan 10
 name DATA
vlan 20
 name VOICE
vlan 30
 name GUEST
vlan 99
 name MGMT

! -- Management interface (the ONLY L3 interface on the switch)
interface vlan 99
 ip address <MGMT_IP> <MGMT_MASK>        ! e.g. 10.99.0.2 255.255.255.0
 no shutdown
ip default-gateway <MGMT_GW>             ! firewall's VLAN 99 address

! -- Access port template (repeat per user port)
interface range gi1/0/1 - 40
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20                ! omit if no VoIP
 spanning-tree portfast
 spanning-tree bpduguard enable          ! kills loops from rogue switches
 no cdp enable                           ! don't advertise on user ports

! -- Guest ports (e.g. lobby drops)
interface range gi1/0/41 - 44
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable

! -- Uplink / trunk to firewall or core
interface gi1/0/48
 description UPLINK-FIREWALL
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99   ! explicit list — never "all"
 switchport trunk native vlan 999            ! dead native VLAN, not 1

! -- Shut every unused port and park it in a dead VLAN
interface range gi1/0/45 - 47
 switchport access vlan 999
 shutdown
----------------------------------------------------------------

INTER-VLAN RULES (enforced on the FIREWALL, not the switch):
  GUEST(30) -> internet only. Deny to 10/20/99 + RFC1918.
  DATA(10)  -> internet + printers/servers as needed. Deny to 99
               except from the IT management host(s).
  MGMT(99)  -> reachable ONLY from IT admin IPs / management VPN.

Deployed by SD Tech Solutions · sd-techsolutions.com
