VLANs are how you keep a cheap smart device or a compromised camera from ever reaching the computers that run your business, by giving each type of device its own lane on the same network. Omada handles this cleanly from the controller, and as a team that designs this separation for businesses every week, here is how we approach it. New to the idea? Our plain-English guide to what a VLAN is explains it first. Labels vary by Omada firmware, so we have focused on what each step achieves.
Step by step
- Plan your lanes first. Decide the groups before you start: typically staff, guest, VoIP phones, CCTV, IoT and card payments. A quick list now saves reworking it later.
- Create a network (VLAN) for each. Go to Settings → Wired Networks → LAN → Create New LAN and give each one a name and its own VLAN ID.
- Assign SSIDs and switch ports. Point each SSID at its VLAN under Settings → Wireless Networks, and set each switch port’s profile under Devices → [your switch] → Ports.
- Lock the doors with ACLs. Under Settings → Network Security → ACL, create gateway and switch rules that block traffic between VLANs by default, opening only the routes you need.
- Place every device on the right lane. Cameras on CCTV, phones on voice, smart gadgets on IoT, tills on payments.
- Prioritise voice. If you run VoIP, give the voice lane priority so calls stay clear under load, as we cover in should your phones be on their own VLAN.
- Test the isolation. From a device on one lane, confirm it cannot reach a device on another. If a guest device can see a till, tighten the ACLs.
The part that does the real work is the ACLs between VLANs, blocking traffic between lanes and allowing only what you need. Creating the VLANs is half the job; the access rules between them are what actually keep a compromised gadget away from your business.
Stuck at any step? VLANs and ACLs are the part people most often get tangled in, and you do not need to be a network engineer to have them done right. We design this separation for businesses every week, so if a device lands on the wrong lane or the rules are not behaving, one call and we will take it from here.
Frequently asked questions
Why put CCTV and IoT on their own VLAN?
Cameras and cheap smart devices are common weak points. On their own VLAN, a compromised one is boxed in and cannot reach your computers, files or payment systems, which contains the damage if it is ever exploited.
How many VLANs does a business need?
As many as you have distinct groups to separate, commonly staff, guest, voice, CCTV, IoT and payments. The rule of thumb: anything you would not want talking to your core systems gets its own lane.
What are ACLs in Omada?
Access control lists are the rules that decide which VLANs can talk to which. They are how you enforce separation, by default blocking traffic between lanes and permitting only the routes you specifically need.
Do I need Omada switches for VLANs?
Yes, VLANs need managed switches and access points that understand them, which Omada kit does. With an OC300 managing Omada switches and APs, you configure VLANs across the whole network from one controller.
How Synergy Max helps
Getting VLANs right, especially the ACLs between them, is where this moves from fiddly to genuinely secure, and it is everyday work for us. We design and configure the separation on your Omada network so staff, guests, phones, cameras and payments each sit in their own lane with only the doors you want open. Our Omada for hotels and HMOs guide shows the common mistakes we fix, and our Omada troubleshooting guide helps when something misbehaves.