NR7101 Why multiple LAN Interface Groups?

Perino
Perino Posts: 2
First Comment
edited January 4 in Mobile Broadband

What's the idea of having multiple LAN Interface Groups?
- Default: 192.168.0.1
- Bridge1: 192.168.1.1
- Bridge2: 192.168.2.1
- Bridge3: 192.168.3.1
- Bridge4: 192.168.4.1

All Replies

  • k1s
    k1s Posts: 57  Ally Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited May 2023

    I think the idea is that if you have the device connected to another (primary) router in IP passthrough mode, and that existing router already uses 192.168.1.x this gives you a way to connect to this device through that router…

    …but it doesn't seem to work

    The setting doesn't seem to take/stick. Mine came configured with 192.168.1.1 as the default and a second group named bridge1, with IP 192.168.2.1. Selecting it and clicking 'Apply' simply takes me back to the home page

  • k1s
    k1s Posts: 57  Ally Member
    First Anniversary 10 Comments Friend Collector First Answer

    IN the menu under Network Settings > Interface Grouping

    The configuration page says:

    Interface Grouping supports multiple ports and bridging groups. Each group will perform as an independent network.

    To support this feature, you must create mapping groups with appropriate LAN and WAN interfaces using the Add button. The Remove button will remove the grouping and add the ungrouped interfaces to the Default group. Only the default group has IP interface.

    1. Enter a unique Group name.2. If you like to automatically add LAN clients to a WAN Interface in the new group, add the DHCP vendor ID string. By configuring a DHCP vender ID string, any DHCP client request with the specified Vendor ID (DHCP option 60), will be denied an IP address from the local DHCP server.

    (1) If a Vendor ID is configured for a specific client device, please REBOOT the client device attached to the router, to allow the client device to obtain an appropriate IP address.(2) Total criteria rules can not add over than 15.

    Doesn't make a lot of sense to me.

  • Perino
    Perino Posts: 2
    First Comment

    Not for me either

  • Internetheavyuser
    Internetheavyuser Posts: 65  Ally Member
    10 Comments Friend Collector First Answer

    Can you screen shot the interface grouping page?

    Did you set it yourself or it comes by default?

    What is your FW version? Can you do reset to default to check?

  • I try to use the grouping function to have a separate network without access to main LAN (br0), from my test, I can create a additional group, select IP address and DHCP server for it, I can connect to it (must have a reboot if not I got mixed result..), but from additional LAN (br1), I can access the formed LAN (not working in opposite direction from my limited test), How to do to have complete isolation between the 2 LAN ?

  • tonygibbs16
    tonygibbs16 Posts: 802  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    I think that what Zyxel call a LAN grouping, Cisco and others call a VLAN.

    Sometimes an independent network is needed so that only the hosts in that independent network can only communicate with themselves and the Internet WAN and no others.

    It would be a security segregation approach.

    Kind regards, Tony

  • Well, that's exactly what I'm looking after, an independant network that can only communicate with themselves and the internet WAN AND NO OTHER.

    But all my test show that this is not the case. When I try a group LAN, I'm able to acces my main network from it, this is NOT normal.

    I even try a guest AP (external guest), and again, If I connect on guest acess, I'm able to see my main network, this is not normal.

    Any solution to really create an safe isolation ? (I have a AX7501-B0 btw)

  • tonygibbs16
    tonygibbs16 Posts: 802  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    Hello @rastapoupoulos

    The AX7501 user guide at https://spdl.zyxel.com/AX7501-B0/user_guide/AX7501-B0_V5.15-V5.17%20Ed%202.pdf says the following about Interface Groups:

    and different networks need a routing function to communicate with each other.

    But the AX7501 also has VLANs, see below.

    So I think that you might be able to use VLAN functionality to get segregation rather than Interface Groups…

    Kind regards,

    Tony

  • Hello tonygibbs16

    Thank for your times, but after lots of trial, I'm not able to do any sensed thinks with this router, thus it will most probably end its life in bridge mode and thats it (I'm a bit sad for the price of the unit and the wifi6 that will become useless)

    This really a pitty that:

    • guest Wifi access give access to LAN (even if set as external guest)
    • grouping lan create a new DHCP server (so far so good), but does not give isolation purpose (possible from new group LAN to go to main LAN (but not opposite direction)
    • vlan does not bring anything (or I miss an important point, but there so little options box that it seem complicated to miss something)
    • firewall rules: I was not able to block anything….

    This product is a joke.

Consumer Product Help Center