Network Design & VLANs

Overview

The HOLOPHONIX processor communicates over two very different kinds of networks at the same time:

• the Dante® network, which transports uncompressed, low-latency multichannel audio (on the Dante® Primary and Dante® Secondary ports) ;
• the Remote network, which carries the web-based control interface, OSC messages, and other show-control traffic (on the Remote port).

These two worlds have opposite requirements. Dante® audio needs a stable, predictable network where every packet arrives on time. Control traffic is irregular by nature: web pages loading, OSC bursts, file transfers, software updates, or a laptop that happens to be on the same network. If both share the same network segment, the irregular traffic can disturb the audio.

This page explains why the Dante® and Remote networks must be isolated from each other, and how to achieve that isolation — either with separate physical switches, or with VLANs on a shared switch.

info

For the IP address configuration of each port of the processor, see Hardware Setup.

Why Isolate the Networks?

What Makes Dante® Traffic Special

A Dante® network is not a regular office network. It has three characteristics that make it sensitive to foreign traffic:

• Constant, high-bandwidth audio flows. A 64-channel Dante® stream at 48 kHz represents roughly 100 Mbit/s of continuous traffic. Unlike file downloads, this traffic never pauses: any congestion immediately translates into audio dropouts.
• Clock synchronization (PTP). All Dante® devices synchronize their audio clocks over the network using the Precision Time Protocol. PTP packets must arrive with microsecond-level timing accuracy. Delays or jitter introduced by unrelated traffic degrade the clock, which can cause pops, clicks, or devices losing sync entirely.
• Multicast traffic. Dante® uses multicast for clocking and device discovery, and optionally for audio flows. Multicast packets are, by default, delivered to every device on the network segment — including devices that have no use for them.

What Happens When Networks Are Mixed

If the Remote network and the Dante® network share the same segment (the same switch without VLANs, or interconnected switches), problems appear in both directions:

• Control devices (computers, tablets, media servers) receive Dante® multicast and PTP traffic they cannot use. This can saturate Wi-Fi access points and slow down the control network.
• Conversely, broadcast and multicast traffic from control devices (device discovery, screen sharing, cloud sync, etc.) reaches the Dante® devices and competes with audio and PTP packets.

warning

Connecting the Remote port to a Dante® network can overload the network and cause important latency issues, audio dropouts, and clock instability. The Remote, Dante® Primary and Dante® Secondary ports must always be connected to three separate networks.

Separating the networks guarantees that each type of traffic stays where it belongs, keeps the audio network deterministic, and makes troubleshooting much easier: a misbehaving control device can never take the audio down.

Two Ways to Isolate

There are two ways to obtain separate networks:

1. Separate physical switches — one switch (or set of switches) per network. This is the simplest and most robust approach: the isolation is physical, and no switch configuration is needed.
2. VLANs on a shared switch — one managed switch is logically divided into several virtual networks. This reduces the amount of hardware, cabling and rack space, at the cost of some switch configuration.

Both approaches are valid. Physical separation is often preferred for touring, where simplicity matters; VLANs are common in fixed installations, where infrastructure is shared between many systems.

What Is a VLAN?

A VLAN (Virtual Local Area Network) is a feature of managed network switches that divides one physical switch into several logical switches. Devices connected to ports assigned to VLAN 10 can only communicate with other devices on VLAN 10 — exactly as if they were plugged into a dedicated, physically separate switch. Broadcast and multicast traffic is contained within its VLAN and never leaks into the others.

Port-Based VLANs

The simplest way to use VLANs is port-based assignment: each physical port of the switch is a member of exactly one VLAN (it carries untagged traffic for that VLAN). The devices themselves need no special configuration — the HOLOPHONIX processor, consoles, stage boxes and computers are completely unaware that VLANs exist. You simply decide, port by port, which virtual network each device belongs to.

This is the recommended method for HOLOPHONIX systems: it is easy to configure, easy to document, and impossible for an end device to break.

Tagged VLANs and Trunks

When a system spans several switches (for example one at front of house and one on stage), each VLAN must be extended between them. Rather than running one cable per VLAN, a single trunk link can carry all VLANs at once. On a trunk port, every Ethernet frame carries an IEEE 802.1Q tag — a small header that identifies which VLAN the frame belongs to — so the switch at the other end can sort the traffic back into the correct VLANs.

info

When sizing a trunk, remember that it carries the sum of the traffic of all VLANs. For large channel counts, use a 10 Gbit/s trunk or a dedicated physical link for each Dante® network.

Recommended Design for HOLOPHONIX

A typical HOLOPHONIX system uses three networks. When implemented as VLANs on shared infrastructure, a common scheme is:

Network	Example VLAN ID	Connected devices	Traffic type
Dante® Primary	10	HOLOPHONIX Dante® Primary port, console, stage boxes, amplifiers	Audio + PTP clock
Dante® Secondary	20	HOLOPHONIX Dante® Secondary port, secondary ports of redundant devices	Audio + PTP clock (redundant copy)
Remote / Control	30	HOLOPHONIX Remote port, control computers, tablets, Wi-Fi access points, OSC/show-control devices	Web UI, OSC, control protocols

A few design rules to follow:

• One port, one VLAN. Assign each switch port to a single untagged VLAN. Reserve tagged (trunk) ports exclusively for switch-to-switch links.
• Avoid using VLAN 1. On most switches, VLAN 1 is the default VLAN where all unconfigured ports land, and often carries switch management traffic. Using dedicated VLAN IDs (10, 20, 30…) makes the configuration explicit and prevents a freshly plugged device from accidentally joining an audio network.
• No routing between the VLANs. The isolation only works if the VLANs remain separate at layer 3 as well. Do not configure inter-VLAN routing between the Dante® and Remote networks.
• Use distinct IP ranges per VLAN. Even though VLANs isolate traffic, giving each network its own IP subnet (for example 10.10.0.0/24, 10.20.0.0/24, 10.30.0.0/24) avoids confusion and makes misplugged cables easy to spot.
• The computer running Dante® Controller connects to the Dante® Primary VLAN. The computer controlling the HOLOPHONIX web interface connects to the Remote VLAN. If a single computer does both, use two network interfaces — never bridge them.

Dante® Redundancy and VLANs

The Dante® Primary and Secondary networks form a redundant pair: audio is sent simultaneously on both, and receivers switch over seamlessly if one fails. Keep in mind:

• Primary and Secondary must be fully separate networks — never connect them together, directly or through a shared VLAN.
• Placing Primary and Secondary on two VLANs of the same physical switch protects against cable and port failures, but the switch itself remains a single point of failure. For maximum reliability, put the Secondary network on a separate physical switch with its own power source.

warning

Never connect the Primary and Secondary Dante® ports to the same network or VLAN. This creates network loops and defeats the purpose of redundancy.

Switch Configuration Guidelines

Beyond VLAN assignment, a few switch settings matter for a healthy Dante® network:

• Use managed gigabit switches. VLANs, QoS and multicast management all require a managed (or at least "smart"/web-managed) switch.
• Enable QoS with DSCP priority. Dante® marks its packets with DSCP values so that switches can prioritize them: clock traffic (DSCP 56, "CS7") must have the highest priority, followed by audio (DSCP 46, "EF"). Configure the switch to trust DSCP markings on the Dante® VLANs. This is essential on mixed-speed networks (100 Mbit/s devices) and on trunk links.
• Disable EEE (Energy Efficient Ethernet / "Green Ethernet"). EEE puts links into micro-sleep states that add jitter and break PTP synchronization. Disable it on every port of the Dante® VLANs — some switches require disabling it globally.
• Manage multicast with IGMP snooping. If your system uses multicast audio flows, enable IGMP snooping (with an IGMP querier) on the Dante® VLANs so that multicast audio is only delivered to the devices that subscribed to it. For small systems using only unicast flows, this is optional.
• Keep the switch management interface on the control VLAN, not on a Dante® VLAN, so that accessing the switch never disturbs the audio.

info

Audinate maintains detailed switch configuration recommendations for Dante® networks at www.audinate.com. When in doubt, check the documentation of your specific switch model.

Quick Checklist

Before powering up the system, verify:

• Remote, Dante® Primary and Dante® Secondary are on three separate networks (physical or VLANs)
• Every switch port is assigned to the correct untagged VLAN; trunks carry tagged VLANs only between switches
• No connection — direct or routed — exists between the Dante® networks and the Remote network
• Each network uses its own IP subnet, matching the processor's port configuration
• QoS (DSCP) is enabled and EEE is disabled on the Dante® VLANs
• The Dante® Primary and Secondary networks are never bridged together

Once the network is in place, continue with the Hardware Setup to configure the processor's IP addresses and the Dante® card.