foofighterjim Posted July 13, 2015 Posted July 13, 2015 This may turn quite long winded so please bear with me. The situation I have at the moment, flat network on 10.122.204.1/22, I have recently introduced Smoothwall and am finally able to play with the IP schema. I am trying to expand the range so I have more IPs available to me I was thinking of changing to 10.122.192.1/20. I believe this would just involve changing the subnet of the existing devices and DHCP scope as the existing IPs would be covered by the new subnet. Is this correct or am I way off the mark? As part of the above I am looking to VLAN wireless traffic only, all of my APs connect to one of three switches (HP 5412zl, HP 5406zl & HP 2530). I can't VLAN wired traffic at the moment as not all of my switches support VLANs and I am unable to replace them due to budget, there are no unmanaged switches between the three aforementioned switches. Here is where my real problems start, I would like to create a VLAN for AP management and have the APs get their IPs from a separate DHCP scope on the main DHCP server but don't actually know how to do it. I would also need to create a separate VLAN for guest access. Here is my logic so far: VLAN 1 (default) - in place to serve all wired traffic (for now). VLAN 50 (AP Management) - Creates a range of IPs for the APs to use, separate from my current DHCP scope. VLAN 60 (Wireless Guest Access) - Gives clients access to nothing but DHCP (separate scope), I can then create a location in Smoothwall to allow internet transparently. I am aware that I may be able to get Smoothwall to be the DHCP server for these devices but don't know how this setup would work with my existing DHCP server. In the above example I believe all ports with APs will need to have VLANS 1, 50 & 60 untagged and all uplink ports back to the core will need these VLANs tagged. The Smoothwall connection to the core switch would have to be tagged with these VLANs too. VLAN1 would still be on these ports for any school owned; group policy controlled devices connecting wirelessly. I am really not sure if this is correct or how to get them to obtain IPs from different scopes or servers (IP Helper??) Apologies for my ramblings, I know what I want to do. I just do know how to get there! I need a drink and a lie down now.
simpsonj Posted July 13, 2015 Posted July 13, 2015 Sounds like my summer work, in the exact same boat, know what I want to do, but not quite sure how to get it all to work... The only advice I can give is to try and keep your current DHCP scope (10.122.204.1) as part of your new dhcp or extended dhcp ip range. Will make life a lot easier as you only have to change the subnet mask and not every single IP address going. But you may get far better advise than I can give, so I'll be following this thread with interest! 1
FN-GM Posted July 13, 2015 Posted July 13, 2015 I would advice you break that /22 network down into separate subnets not make it bigger. I wouldn't go over 240 Devices per subnet. If you split it up your network performance will be better. 1,000 devices broadcasting on the network will have quite a hit on performance.
foofighterjim Posted July 13, 2015 Author Posted July 13, 2015 (edited) I would advice you break that /22 network down into separate subnets not make it bigger. I wouldn't go over 240 Devices per subnet. If you split it up your network performance will be better. 1,000 devices broadcasting on the network will have quite a hit on performance. Wouldn't I need a router in place to do this? The only router I have is from the ISP which I don't control. Or are you saying that my 5412zl should be able to do this? I was hoping that the VLANs would help reduce the broadcast traffic. Edited July 13, 2015 by foofighterjim
themightymrp Posted July 13, 2015 Posted July 13, 2015 I agree with @FN-GM - split it down first. If you need more IP's overall you can still adjust your subnet to the /20. Using the /20 this could split down to 16 subnets with a /24 subnet mask, or even 8 subnets with a /23 mask. However, as you've said not all switches support VLAN's, this might be a starting point: 1) Make sure your DHCP server connects into a layer-3 capable switch (which I think they are). This is essential for using multiple DHCP scopes (see below) 2) You are correct in that the IP addresses of current devices can stay the same and just the subnet will be different. However, it may be worth setting up reservations in DHCP for those devices which always use the same IP. 3) Create multiple DHCP scopes based upon your new address ranges. For example, using the /20 as a starting point you could create scope 1 as 10.122.192.0 /24 (254 addresses), scope 2 as 10.122.193.0/23 (510 addresses), scope 3 as 10.122.195.0/24 (254 addresses) and so on. Just work your way up the numbers (or down maybe in your case) 4) Any switch to switch connections will need the vlans as TAGGED. Any switch to device connections are generally UNTAGGED. Where you have AP's, what type of wireless are you using? We use Unifi and prior to that we had Cisco. You should be able to specify which VLAN your SSID is assigned to. For example, you may have 2 SSID's setup on your units - staff and BYOD. You could assign the staff SSID to vlan 10 and the BYOD to vlan 20. The actual AP itself may have an IP range in VLAN 1. At this point, on the switch you would UNTAG VLAN 1 and TAG vlans 10 and 20. The AP unit will separate them out for you. 5) The reason for the layer 3 switch is that as you create your vlans/IP addresses on the switch, it will create a routing table which will forward DHCP requests for each subnet to the relevant DHCP scope. This is the easiest part! I can expand on these more, just ask I had to do something very similar to what you're doing about 3 years ago 2
themightymrp Posted July 13, 2015 Posted July 13, 2015 EDIT - vlans WILL be able to reduce your broadcast traffic. Just try to make each vlan as small as it needs to be to cover the devices. Theres no point in a vlan that support 500+ IP addresses when you only need 200. I split our network into /25 subnets (255.255.255.128) and assigned each subnet to an IT suite. Its still overkill but much smaller broadcast domains
FN-GM Posted July 13, 2015 Posted July 13, 2015 Wouldn't I need a router in place to do this? The only router I have is from the ISP which I don't control. Or are you saying that my 5412zl should be able to do this? I was hoping that the VLANs would help reduce the broadcast traffic. Yes, however you may find your core switch is a layer 3 switch. This would mean its both a router and a switch. 2
foofighterjim Posted July 14, 2015 Author Posted July 14, 2015 Thanks for the clarification @FN-GM & @themightymrp (We use Aerohive BTW) I will only be able to go so far with this as I mentioned I can't currently VLAN wired traffic due to deficiencies at the edge. So in theory I can keep my current wired traffic on 10.122.204.1/22 and VLAN by location at a later date. I can just setup a VLAN with 10.122.201.129/25 for the APs and 10.122.202.1/23 for Guest access? I think this makes sense its just how to get the VLAN'd devices to get IPs from the correct scope?
themightymrp Posted July 14, 2015 Posted July 14, 2015 Those ranges seem to work on paper (I think). So from what you've said in the OP, your AP's all connect into those 3 switches and those 3 switches are connected to each other without any unmanaged switches inbetween? As long as at least one of those switches is layer-3 you should be fine. On your DHCP server create the 2 additional scopes for AP's and wireless clients. Makes sure the DHCP server connects to a layer-3 switch. On this switch, it should already have an IP address and this will be a part of VLAN 1. Now create on the switch VLAN's 50 and 60. For each of these, configure an additional IP address, one each from the new DHCP ranges. These IP's will become the default gateway addresses for your new VLANs (good idea to pre-plan these when you create the scopes!). You should now have 3 VLANs configured, each with an IP address in their respective range. Go ahead and create those additional 2 VLANs on your other switches (they don't need an IP). The VLAN 1 traffic will already be untagged across all your connections. For the switch to switch connections of your 3 switches, TAG both vlan 50 and 60. On the ports where you will connect your AP's, have VLAN 50 (the AP's address range) UNTAGGED, and have VLAN 60 (clients) TAGGED. Now on your AP's, set the AP itself to either a static IP in your new range or let it pick one up via DHCP (a great way to test it worked!). Now configure your SSID. There should be a setting somewhere on the config page to allocate this SSID to a VLAN number. Set it to 60. Test and test - that 'should' be it. 2
foofighterjim Posted July 14, 2015 Author Posted July 14, 2015 As long as at least one of those switches is layer-3 you should be fine. On your DHCP server create the 2 additional scopes for AP's and wireless clients. Makes sure the DHCP server connects to a layer-3 switch. On this switch, it should already have an IP address and this will be a part of VLAN 1. Now create on the switch VLAN's 50 and 60. For each of these, configure an additional IP address, one each from the new DHCP ranges. These IP's will become the default gateway addresses for your new VLANs (good idea to pre-plan these when you create the scopes!). You should now have 3 VLANs configured, each with an IP address in their respective range. Go ahead and create those additional 2 VLANs on your other switches (they don't need an IP). So for example if the switch has IP 10.122.201.129 on 255.255.255.128 for VLAN 50 this will be the default gateway for all devices on that VLAN. Because this IP would be in the scope for 10.122.201.129 - 10.122.201.254 (but reserved I presume), the devices from VLAN 50 will automatically obtain IPs from that scope? Sorry for being so thick. Re Aerohive, It is very straightforward to get the VLANs set on there so I'm not too worried about that at the moment.
themightymrp Posted July 14, 2015 Posted July 14, 2015 Pretty much yep. Just thinking about it, you may have to specify the IP address of the DHCP server on the switch too. My bad, I don't do it every day - more coffee required!!. Depending on the interface of your switch (web GUI or command line) there will either be an option to specify the dhcp server on a page OR for each vlan you add a config line of: ip helper-address 10.122.?.? (enter IP of DHCP server) 1
foofighterjim Posted July 14, 2015 Author Posted July 14, 2015 Pretty much yep. Just thinking about it, you may have to specify the IP address of the DHCP server on the switch too. My bad, I don't do it every day - more coffee required!!. Depending on the interface of your switch (web GUI or command line) there will either be an option to specify the dhcp server on a page OR for each vlan you add a config line of: ip helper-address 10.122.?.? (enter IP of DHCP server) Thanks for your help, I think I will start writing my config down, making sure I have the subnets correct (I am pretty sure they are) and start making changes during the holidays. This is the biggest problem of not having a test network to play with! Must remember to start backing up the switch config regularly now! Looks like my summer just got a little easier now I'm not expanding the existing range and will just be playing with the VLANs, at least I can undo everything in minutes if I do something wrong. Thanks again for your help.
themightymrp Posted July 14, 2015 Posted July 14, 2015 I'm pretty sure your addresses are right. You can always go to Online IP Subnet Calculator to double check
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 So I have hit a bit of a brick wall with this. I have setup a new scope 10.122.201.128 255.255.255.128 (for use with VLAN 50) on the DHCP server (which is on VLAN 1). I have excluded 10.122.201.129 from being distributed by DHCP as this is the Switch IP for VLAN 50. I have set IP Helper for VLAN 50 to 10.122.204.69 (the DHCP server on VLAN 1), I have tagged VLAN 50 on the ports connecting to the server with VLAN 1 set to Untagged. I have isolated one port for testing which has VLAN 50 untagged and VLAN 1 tagged and connected a laptop to it for testing. Unfortunately the laptop does not acquire an IP, however if I set the laptop with the IP 10.122.201.130, Subnet 255.255.255.128 and Default Gateway 10.122.201.129. I can ping the default gateway, I can't however ping the DHCP server (10.122.204.69). I believe this is where my problem is as I think I have everything set correctly on the switch. I am not sure how to trouble shoot this.
IrritableTech Posted August 4, 2015 Posted August 4, 2015 Is routing enabled? You could always let us look at your config - shouldn't be any confidential details included, but check. If you confirm where your DHCP server is plugged in, and the client someone should be able to help.
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 (edited) Is routing enabled? You could always let us look at your config - shouldn't be any confidential details included, but check. If you confirm where your DHCP server is plugged in, and the client someone should be able to help. I am certain it is, config below. The server is a VM so I tagged all ports going to ESX hosts (A1-12), Laptop is connected to A24. Running configuration: ; J8698A Configuration Editor; Created on release #K.15.12.0012 ; Ver #05:08.41.ff.3f.ef:63 hostname "HP-5412zl" module 1 type j9534a module 2 type j9536a module 3 type j9534a module 4 type j9534a module 5 type j8706a module 6 type j9309a trunk F1-F2 trk1 trunk timesync sntp sntp unicast sntp server priority 1 10.122.204.69 ip default-gateway 10.122.204.49 ip routing interface F1 disable exit snmp-server community "public" unrestricted snmp-server location "Server Room" vlan 1 name "DEFAULT_VLAN" untagged A1-A23,B1-B22,C1-C24,D1-D24,E1-E24,F3-F4,Trk1 tagged A24 ip address 10.122.204.81 255.255.252.0 exit vlan 50 name "Wireless Management" untagged A24 tagged A1-A12 ip address 10.122.201.129 255.255.255.128 ip helper-address 10.122.204.69 exit vlan 55 name "Wireless Staff" ip address 10.122.202.1 255.255.255.0 exit vlan 60 name "Wireless Guest" ip address 10.122.203.1 255.255.255.0 exit vlan 150 name "Printers" no ip address exit spanning-tree spanning-tree Trk1 priority 4 no autorun no dhcp config-file-update no dhcp image-file-update password manager Edited August 4, 2015 by foofighterjim
IrritableTech Posted August 4, 2015 Posted August 4, 2015 I am certain it is, config below. Ta. Where are your devices plugged in? The DHCP server and the client.
FN-GM Posted August 4, 2015 Posted August 4, 2015 (edited) You need to stop using VLAN 1 really. VLAN 1 is the native VLAN by default. Its a massive security risk for access ports & the native VLAN to share the same VLAN number, it will enable a hacker to use VLAN hopping. Also it does weird and wonderful stuff with DHCP. I have seen it give IP addresses for 1 vlan to clients in another. Do one of the following Stop using VLAN 1 for all end devices. (preferred) Change the native VLAN on all your trunks to something else. Also a little off topic what is the device on ip 10.122.204.49? Edited August 4, 2015 by FN-GM
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 Ta. Where are your devices plugged in? The DHCP server and the client. Sorry, I had just edited my reply. The server is a VM so I tagged all ports going to ESX hosts (A1-12), Laptop is connected to A24.
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 You need to stop using VLAN 1 really. VLAN 1 is the native VLAN by default. Its a massive security risk for access ports & the native VLAN to share the same VLAN number, it will enable a hacker to use VLAN hopping. Also it does weird and wonderful stuff with DHCP. I have seen it give IP addresses for 1 vlan to clients in another. Do one of the following Stop using VLAN 1 for all end devices. (preferred) Change the native VLAN on all your trunks to something else. I can't, not all of my switches support VLANs at the moment (I know, don't get me started on that). The best I can do for now is VLAN my wireless traffic as all APs are connected to Layer 2 or 3 switches.
FN-GM Posted August 4, 2015 Posted August 4, 2015 I can't, not all of my switches support VLANs at the moment (I know, don't get me started on that). The best I can do for now is VLAN my wireless traffic as all APs are connected to Layer 2 or 3 switches. You should be able to. For the access ports that connect to unmanned switches change the VLAN on these ports.
IrritableTech Posted August 4, 2015 Posted August 4, 2015 Sorry, I had just edited my reply. The server is a VM so I tagged all ports going to ESX hosts (A1-12), Laptop is connected to A24. Good advice from @FN-GM but whilst we're still trying to get things working... Your server ports which are tagged within you switch config need to be tagged within ESX. In HP lingo 'tagged' effectively means allow packets to pass which are already tagged with this VLAN. Your client port most likely needs to be untagged within VLAN50 and not tagged in VLAN1. 'Untagged' effectively means tag packets on this port with this VLAN and forward them. HP terminology is a little confusing. So VLAN1 shouldn't need to be tagged on A24 (client port) and VLAN50 shouldn't need to be tagged on A1-A12 (server ports) 1
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 Your server ports which are tagged within you switch config need to be tagged within ESX. I have been using this guide for the ESX part: VMware KB: Sample Configuration - ESX/ESXi connecting to physical switch via VLAN access mode and External Switch VLAN Tagging (EST Mode) it suggests that as long as the hosts network properties are set to 0 or none it should get through. All of my hosts are set to 0. I removed the tagged ports from A1-12 for VLAN 50 and from A24 from VLAN 1, unfortunately this hasn't changed anything. One thing I have thought about is the default gateway of the DHCP server, it is currently set to 10.122.204.49 (Our Smoothwall IP) should it rather be the VLAN 1 Switch IP (10.122.204.81)? I haven't tested it because when I changed it the server lost connection to the internet.
IrritableTech Posted August 4, 2015 Posted August 4, 2015 I have been using this guide for the ESX part: VMware KB: Sample Configuration - ESX/ESXi connecting to physical switch via VLAN access mode and External Switch VLAN Tagging (EST Mode) it suggests that as long as the hosts network properties are set to 0 or none it should get through. All of my hosts are set to 0. I removed the tagged ports from A1-12 for VLAN 50 and from A24 from VLAN 1, unfortunately this hasn't changed anything. I don't configure our physical hosts or virtual machines to be honest - I've done it all on my switches. Untagging the ports in my servers VLAN. One thing I have thought about is the default gateway of the DHCP server, it is currently set to 10.122.204.49 (Our Smoothwall IP) should it rather be the VLAN 1 Switch IP (10.122.204.81)? I haven't tested it because when I changed it the server lost connection to the internet. Yup - all your devices will need to use the switches IP address within the same VLAN as their gateway. You then let the switch handle it from there. Your DHCP server is (probably) getting the DHCP request (can you see a lease?) but the client isn't getting that information because the DHCP server is sending it straight to the smoothwall.
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 Yup - all your devices will need to use the switches IP address within the same VLAN as their gateway. You then let the switch handle it from there. Your DHCP server is (probably) getting the DHCP request (can you see a lease?) but the client isn't getting that information because the DHCP server is sending it straight to the smoothwall. So I need to change the default gateway on my domain to 10.122.204.81? Do I then need to set anything on the switch so devices can find their way out to the Smoothwall? There is no lease for the laptop it just gets 169.254.115.188 255.255.0.0
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now