Changing IP range

[localzuk]

So, this summer's job is to migrate our network from our current address range to a new, expanded, one.

Obviously, this is going to be a big job, so I want to make sure I remember everything I'll need to do:

Here is what I've thought of so far.

Active Directory Server
DNS Server
DHCP Ranges
HP Switches
Edge Router
Firewall
Printers
IP Phones
Digital Displays
Ubuntu servers (kerberos fix)
VM Servers
IAS Server
Proxy Server
CachePilot
Terminal Servers/Citrix Servers
Door Control Server
iSCSI SAN box

So, the big questions are - where to start? My guess would be to create my new VLANs on the switches, leaving the old ones in place, then move things on to them - starting with the AD/IAS/DHCP/DNS and then everything else after that. Anything else I've forgotten or should do?

[matt40k]

Any reason why you need the new range? Could you have multiple VLANs then (interVLAN) route between them? Just an idea.

I know the Door Control stuff can be an arse, I assume it's a lot better then when I last changed an IP, this was back in the day of the server app being written in Java and only ran on Windows 2000 Server, this was just after the MS\Sun Java issue, (SP4 era).

[FN-GM]

Do you have a cashless system?

[localzuk]

Any reason why you need the new range? Could you have multiple VLANs then (interVLAN) route between them? Just an idea.

I know the Door Control stuff can be an arse, I assume it's a lot better then when I last changed an IP, this was back in the day of the server app being written in Java and only ran on Windows 2000 Server, this was just after the MS\Sun Java issue, (SP4 era).

Running out of IP addresses, and when we get the new range up and running, we lose the old range (they are assigned by our LEA).

Our door system shouldn't be too much of an issue, as it is a paxton system, so it is just a windows xp box with a static IP at the moment.

Do you have a cashless system?

Nope, I'm still custom building our own.

[coquet636]

We changed ours 2 years ago for the same reason old lea ranges.

First make sure current ip data on servers and switches and printers are up to date, we had a few printers that were different so had to reset the io card in them which wasnt hard but added time and was a pest..

Then we started with the switches, then servers starting with DC's then ISa server, Smoothwall server etc.

Then setup a new DHCP range and just disabled the old one till we were sure the new one was working....

All in all it was less painful than i thought.

[matt40k]

Running out of IP addresses, and when we get the new range up and running, we lose the old range (they are assigned by our LEA).

[jiberish]
Never got this, if you setup the new range, move over what little things the LEA maintain (SIMS server\admin workstations etc) and the router, then setup a route from the old to the new. Still complete hack job. Would only really 'work' if you went completely for it. Ie a 192.168.x.x address for each IT room for example, still rather overkill, I'll shut up now. It would however stop this issue occuring in the future however
[/jiberish]

[localzuk]

[jiberish]
Never got this, if you setup the new range, move over what little things the LEA maintain (SIMS server\admin workstations etc) and the router, then setup a route from the old to the new. Still complete hack job. Would only really 'work' if you went completely for it. Ie a 192.168.x.x address for each IT room for example, still rather overkill, I'll shut up now. It would however stop this issue occuring in the future however
[/jiberish]

The LEA regularly connect to machines throughout the school to assist with SIMS.net and FMS problems. If we ended up using a NAT system, whereby we have our own IP address range and NAT things to the machines as necessary, this would overly complicate things for both myself, and for staff trying to tell people what address to connect to for remote admin.

[sted]

id be tempted to set all switches and other network devices to dhcp now but give them a reserved address thats the same as their manual one then when new range is sorted just copy their mac to the new dhcp scope and assign them a new ip that way

[matt40k]

The LEA regularly connect to machines throughout the school to assist with SIMS.net and FMS problems. If we ended up using a NAT system, whereby we have our own IP address range and NAT things to the machines as necessary, this would overly complicate things for both myself, and for staff trying to tell people what address to connect to for remote admin.

The admin machines etc would be using the new address, it would be just be the curriculum, printers, etc that would be, as you put it, NAT. Anyway, just an idea.

Anyway, good luck. Sure it'll go fine as you seem good with your planning.

[FN-GM]

Do you have a reverse proxy?

[localzuk]

Do you have a reverse proxy?

For our school website, yeah.

[GrumbleDook]

This is being planned in one of our schools at the moment for a similar reason but since it is a primary they are having to do a complete swap the way you are.

1 - You are told in advance what you new range is and you can have you spreadsheets set up in advance (spreadsheets you wonder?)
2 - export your DHCP so you get your MAC addresses and mangle them in the spreadsheet so you have IP reservations ready to roll.
3 - Make sure the list you put above (in your post) is up to date and you are ready to roll.
4 - The LA / RBC bind the new range to your router and allow routing between the two ranges.
5 - Set up any new VLANs as needed
6 - New DHCP scope and use IP reservations to move things over.
7 - Change network hardware
8 - turn off old DHCP scope and see what moans.
9 - The Dude is your friend ... scan and re-scan just in case.
10 - give the thumbs up to your LA.

The alternative option (if you have a decent Layer 3 core switch) is to make your core switch the default gateway, run the new range through that to start with for routing ... but the above should work if you are not too sure about whether your core switch will deal with it.

There are plenty of good guides out there for super-netting too ... plenty of options available.

[EduTech]

So we're not the only school planning on doing this change in the main holiday, myself and my boss still have to plan for this.. time is coming closer now so i think it is time we made a start. thanks for the input so far it will help us as well :-)

The reason for us having to do this is the fact when our network was first configured, the Internal IP Range was on the same subnet as our LEA Range. Now we have our own ISA Box as you guys have done this will know you can have your INTERNAL and EXTERNAL NIC's on the same Range. as our EXTERNAL Card has to be an IP given to us by the LA we need to change our whole Internal Range so it does not sit inside the same Subnet! oh the joy :-)

Hopfully if we plan it right, there should be no Major Issue's (TOUCH WOOD)

James.