RT-BE88U can the SFP+ 10G be used for LAN and DDNS in double NAT possible with ASUS stock firmware?

[mmjlmjl]

I've searched hard and long to find this on the form and via google, but no definitive answer could be found. Before I run off and order one I'd like to know these 2 features:

I'd like this router as my main router, however my ISP is only 250Mbit anyways so no need for a 10G WAN. can a 1G (or if not possible the 2.5G) port be used for WAN and then all other ports to connect to LAN? I'd prefer to connect the 10G SFP+ to my main switch using TiwnAX or SFP+Glassfiber and my NAS to the 10G ethernet port.

RT-BE88U can the SFP+ 10G be used for LAN (or is it really WAN only as in specs)

Second question: With the ASUS stock firmware (3.0.0.9 branch) can DDNS be used in a double NAT configuration? I know in MERLIN you can, not sure if the ASUS firmware (as there is currently no MERLIN support for this router) now also has this feature.

 

[WTOram]

The 2.5Gbps Lan1 port can also be used for WAN. This is the way that I had mine configured until I encountered an unrelated IPv6 issue that requires a firmware fix. The only downside of this is that it appears that 802.3ad Lan link aggregation on the BE88U appears only to support bonding the Lan1 and Lan2 ports - so if you use Lan1 as your WAN port, then this feature would be unavailable to you should you want to use it.

It appears to me, that the 10Gbps SFP+ port can be used as a LAN port (and possibly only as a LAN port) in contrast to what is said in the Techical Spec on the ASUS web site. This is what I see in the port status panel of my RT-BE88U

I could be wrong however, because the port status diagram clearly shows that the 10G port is used as the WAN port - this despite the fact that my RT-BE88U is currently configured as an Access Point with the 2.5G WAN/LAN1 port being used for the uplink connection to my old AX88U which is still handling my internet connection (including IPv6 support).

 

[mmjlmjl]

The 2.5Gbps Lan1 port can also be used for WAN. This is the way that I had mine configured until I encountered an unrelated IPv6 issue that requires a firmware fix. The only downside of this is that it appears that 802.3ad Lan link aggregation on the BE88U appears only to support bonding the Lan1 and Lan2 ports - so if you use Lan1 as your WAN port, then this feature would be unavailable to you should you want to use it.

It appears to me, that the 10Gbps SFP+ port can be used as a LAN port (and possibly only as a LAN port) in contrast to what is said in the Techical Spec on the ASUS web site. This is what I see in the port status panel of my RT-BE88U

View attachment 60998

I could be wrong however, because the port status diagram clearly shows that the 10G port is used as the WAN port - this despite the fact that my RT-BE88U is currently configured as an Access Point with the 2.5G WAN/LAN1 port being used for the uplink connection to my old AX88U which is still handling my internet connection (including IPv6 support).

So one maybe

Anyone who tried this? Using the SFP+ as a 10Gbit LAN port?

Preferably I would use a 1GB port for WAN but your screenshot seems to disagree with that hope.

 

[jzchen]

Instant Guard does not work in a double NAT situation, ie in Access Point Mode. DDNS may be disabled due to the detail explained below. (I was able to get Instant Guard to work for a while after switching from Router to Access Point but that stopped working after an update. I just switched from Router to Access Point within the last week and IG immediately stops working). EDIT- This is with V1 BE98 Pro, sorry...

Technically speaking in Access Point Mode your BE88 is using a LAN port as uplink, not a WAN port, if that helps clarify things any. It's because many ports support both functions that make things confusing...

 

[jzchen]

The specs say any of the 4 1 Gbps ports can be used either as LAN/WAN, as well as the 2.5 Gbps port. Seems like you're set:

I/O Ports
1 x 10Gbps for WAN/LAN, 1 x 10Gbps SFP+ for WAN, 1 x 2.5Gbps for WAN/LAN, 3 x 2.5 Gbps for LAN, 4 x RJ45 10/100/1000Mbps for WAN/LAN, USB 3.2 Gen1 x1

EDIT- Can't answer your SFP+ as LAN question I'm afraid...

 

[enter666]

I have the SPF+ used as LAN 10Gbps port connected with a ETH transceiver. And you can use the other ETH 10Gbps as LAN either if your primary WAN switch to the 2.5Gbps from DualWan tab. I can't show

you because I can't use the 2.5Gbps Wan port because I use a LinkAggregation connection bounded to LAN1 and LAN2 connection.

 

[mmjlmjl]

I tried the 3..0.0.6 stock Asus firmware for my XT12, double NAT and DDNS is working fine, my assumption would be that this will also work for the RT-BE88U.

The specs say any of the 4 1 Gbps ports can be used either as LAN/WAN, as well as the 2.5 Gbps port. Seems like you're set:

I/O Ports
1 x 10Gbps for WAN/LAN, 1 x 10Gbps SFP+ for WAN, 1 x 2.5Gbps for WAN/LAN, 3 x 2.5 Gbps for LAN, 4 x RJ45 10/100/1000Mbps for WAN/LAN, USB 3.2 Gen1 x1

EDIT- Can't answer your SFP+ as LAN question I'm afraid...

If I look at the specs @Asus website it only states that the 1G ports are LAN, not WAN

"1 x 10Gbps for WAN/LAN, 1 x 10Gbps SFP+ for WAN, 1 x 2.5Gbps for WAN/LAN, 3 x 2.5 Gbps for LAN, 4 x RJ45 10/100/1000Mbps for LAN, USB 3.2 Gen1 x1"

RT-BE88U - Specificaties｜Wifi-routers｜ASUS Nederland

Dual-band WiFi 7 router met snelheden tot 7200Mbps. Twee 10G-poorten, vier 2.5G-poorten en vier Gigabit-poorten.

www.asus.com

This poses some challenges for my secondary WAN, I'd hate to lose both 2.5G and 10G ports for 1G WAN connections. Anyone experience in using a USB cable and an iPhone with Tethering as secondary WAN? I now use a GL-iNet router for this in emergency cases.

And one new question: How many DHCP reservations are possible? I have quite a few and 64 won't cut it

 

[Dichy]

I'll show you my configuration so you can find out if it helps to answer your questions:

2.5Gbit WAN/LAN used as WAN
10Gbit WAN/LAN used as LAN

With this configuration few days ago I did a test adding a SFP+ 10G RJ45 port and even that port worked as LAN.

If you need further information just ask ;-)

 

[mmjlmjl]

I'll show you my configuration so you can find out if it helps to answer your questions:

2.5Gbit WAN/LAN used as WAN
10Gbit WAN/LAN used as LAN

With this configuration few days ago I did a test adding a SFP+ 10G RJ45 port and even that port worked as LAN.

If you need further information just ask ;-)

Thanks, I went ahead and ordered one (RT-BE88U) at amazon (I can always return it in 30 days if It does not work out).

1. Double or even Triple NAT is fine: DDNS from Asus can handle it (Firmware 3.0.0.6.102_33921)
2. If using single WAN you can only select: 10G ETH or SFP, 2.5G LAN/WAN or USB
3. On dual wan you can also select one of the 2.5G or 1G LAN ports as secondary, however, you then also need to define a secondary WAN which is USB, 10G (ETH or SFP) or 2,5 G WAN/LAN1- I hoped to be able to select a 1G port for both primary and secondary WAN, it would seem possible technically but it is not programmed in this firmware version. I have opted to use 1G LAN5 as primary and USB as secondary WAN, would just need an extension cord of 10m for USB to connect my phone at my desk (or move the router...).
4. DHCP reservations: maximum of 128.
5. VLAN assignments: If a 1G LAN and USB are selected for dual WAN the following ports show up: 2.5G WAN/LAN1, 2,5G LAN2.3 and 4, 1G LAN5,6,7, and 8, 10G SFP+ This said, a remark is given on the page that in my case LAN5 is used as WAN in a DUAL WAN setup. Notably the 10G WAN/LAN Ethernet port is not in this configuration page. I will test this weekend on the functionality, it might just be that the port carries all VLANS tagged and VLAN 1 = intranet untagged and cannot be assigned a single untagged VLAN (Access mode) through this web interface. FYI I create 5 VLANS in the Guest Network Pro section
6. Surprisingly I cannot access any device in IOT VLAN form VLAN1: this is completely isolated unless you make it part of your VLAN1.... I assume they then use AP isolation, which only works for Wi-Fi devices I'd assume, I also need this form my wired IP camera's connected to a managed PoE switch. This is seemed to be solved, however, by choosing a Guest Network profile, in my case I configured it without Wi-Fi scheduling, just an SSID and after creation change to my preferred VLAN3 number and ip range. Connecting from VLAN1 to this Guest VLAN is possible (I could connect to the IP cam). A device in the guest VLAN3 cannot connect to VLAN1 so that works as intended, also test AP isolation works as well within VLAN3. Unfortunately, this is only temporary when submitting a change in any settings of the router, after a short time the connection can no longer be established once a change in settings is complete. i.e. If I change a DHCP reservation and press "Apply", for a brief period I can access a device in another VLAN, after some time the connection is no longer possible. First Showstopper, maybe this can be managed by a static rule or firewall rule to allow one way traffic from Guest to Intranet? (I asked in a sperate post, but no solution yet https://www.snbforums.com/threads/h...st-pro-on-3-0-0-6-firmware.91846/#post-926084)

Points I'm going to figure out next:

• Can IP reservations be done in the VLANS? - I assume this will take up space in the 128 DHCP reservations and can be entered in the same list. This would pose quite a limitation, I already have many IP reservations in my Intranet, IOT IPs might be too many, I'd need to make some choices there.
  • I tried this, I got an error when selecting a device in VLAN6 (192.168.6.x range). "<IP> is not a valid IP address!". I tried setting the reservation to the VLAN1 range thinking it might use that in other vlans... did not work, I get a random IP for my camera which does not work for all my devices, I need to have a fixed IP to integrate them in home assistant, and for some devices it is not possible to define a fixed IP (manually) in the device. I am afraid this could be the second showstopper and the router will be returned (unless anyone has a brilliant idea on this (without adding another device for DHCP in the vlans...).
• Does the 10G ETH/WAN port carry all the VLANs or just one? Either would be fine for me, uplink to the main switch can be done using the SFP port which does carry them all, but good to know. As this port does not show up in the VLAN assignment case there would be no way to set a particular vlan to this port. For me this would be OK as I would use the port to connect a PC which only needs VLAN1. I first tried to see if the Port works with a laptop connected by cable. I can access the VLAN1 (router and attached managed switch) and Internet, however, I cannot access anything in the Guest VLAN3 (see point 6 above) IP camera. Connecting a managed switch results in an IP assignment in one of the VLANS so it seems to work, still point 6 above needs to be solved...

Conclusion: After attempting many options: using the ASUS stock management accessing any guest or VLAN from the main LAN is not possible (unless you provide access to the "intranet", which defeats the purpose. For me this gives me only a few options:
A) Keep using double NAT: The first Router is the guest/iot network. From the second router (connected with DMZ from first router) you can access the first router lan but from the first router you do not get to the second - ASUS DDNS (even twice) can still be used.
B) Put IOT devices I need to get data from in intranet/main vlan, I prefer not to, put any guest and iot devices in isolated vlans - ASUS DDNS can still be used.
C) Use a proper router to manage VLANS, DHCP etc use ASUS as VLAN enabled AP's - ASUS DDNS can no longer be used, this only works in router mode not in AP mode.

In any case the RT-BE88U did not add enough (router) functionality for me (inflexibility of assigning VLANS to each individual port & access to devices in isolated vlans from Intranet) the unit has been returned and I'll stick with option A for now (may try B in the future).