VLAN Clarification Required

[ICTNUT]

Hi All,

 

I walked into my current position nearly 3 years ago and VLANs were already in place and as things were working I did not bother looking at it.

 

I am now going through a large renovation and expansion project which is resulting in putting in new switches with VLANS and things are not playing ball.

 

I have done a fair bit of VLAN google'in and apreciate the fact the VALNS can be set up on Layer 2 /3 switches but as yet nowhere have I found a definative if you set a switch up like this then you will need to setup your other swicthes like that.

 

Brief Background

 

VLAN 1 - contains all the server and switches and as you can see the server swicth connects to the back

 

VLAN 2 - All the admin PC that run SIMS

 

VLAN 3 - All student PC's and other non admin PC's

 

To this end I have put together a quick visio and would like the following questions answered if possible:

 

1 - What is the correct way to setup the back bone connections bearing in mind that these need access to all 3 VLANS

 

2 - What is the correct way to setup the VLAN2 and VLAN3 ports currently these ports are configured as UnTagged on all three VLANS <- I don't think this is right.

 

3 - What is the correct setup for the server switch considering ALL network devices will need access to them.

 

There will be more questions I am sure but I need to get the basics covered first....

[Geoff]

You might want to read the 'switch configuration' section of my VLAN HOWTO for Linux where I cover the basic concepts of VLANs and give a practical example.

 

1 - What is the correct way to setup the back bone connections bearing in mind that these need access to all 3 VLANS

 

Disable untagged packets. Enable tagging for all 3 VLANS.

 

2 - What is the correct way to setup the VLAN2 and VLAN3 ports currently these ports are configured as UnTagged on all three VLANS <- I don't think this is right.

 

First, you need to look at your switch configuration for each port and find out what it's been told to do with untagged data.

 

3 - What is the correct setup for the server switch considering ALL network devices will need access to them.

 

If you want to use VLANs to separate broadcast domains as per your diagram, you will need to use a router to route traffic between each network segment.

[ICTNUT]

geoff,

 

You might want to read the 'switch configuration' section of my VLAN HOWTO for Linux where I cover the basic concepts of VLANs and give a practical example.

 

Thanks for this I will look into it now.

 

Disable untagged packets. Enable tagging for all 3 VLANS.

 

Ok ALL are set to untagged so this needs to be changed, i'll look into this as part of my plans.

 

First, you need to look at your switch configuration for each port and find out what it's been told to do with untagged data.

 

Each switch can have a number of dedicated admin (VLAN2) ports and curriculum ports (VLAN3). Looking at one switch in particular the VLAN2 port are set to have thier PVID = 2 and the VLAN3 ports are set to PVID = 3 and then the ports are simply set to untagged. The Backbone feed ports that link the switch to the backbone are set to tagged on all 3 VLANS with the primary VLAN ID set to 1

 

If you want to use VLANs to separate broadcast domains as per your diagram, you will need to use a router to route traffic between each network segment.

 

OK this is what I want to do as this will also allow me to control DHCP and ThinClients. Now the Layer 2 switches do not have an "IP-Helper" facility so what do you recommend as a router for this cause??

 

Thanks for the help thus far :-)

[Geoff]

Ok ALL are set to untagged so this needs to be changed, i'll look into this as part of my plans.

 

Yes, there's no reason to have untagged packets floating around on your uplinks. Hopefully the switch at other end is configured to throw them away. But you can't count on that. So you might end up with untagged packets ending up somewhere they shouldn't. eg, crossing VLANs. This can be especially amusing if it's DHCP.

 

Each switch can have a number of dedicated admin (VLAN2) ports and curriculum ports (VLAN3). Looking at one switch in particular the VLAN2 port are set to have thier PVID = 2 and the VLAN3 ports are set to PVID = 3 and then the ports are simply set to untagged.

 

Yes, that's sane.

 

The Backbone feed ports that link the switch to the backbone are set to tagged on all 3 VLANS with the primary VLAN ID set to 1

 

What I'd expect is the primary VLAN would be the least dangerous network. So for most of us that'd be the curriculum network.

 

what do you recommend as a router

 

Me, I'd just get an old box and stick Linux on it. If you don't fancy that option, there's lots of nice second hand Cisco kit on ebay.

[ICTNUT]

Geoff,

 

What I'd expect is the primary VLAN would be the least dangerous network. So for most of us that'd be the curriculum network.

 

I agree but how does that affect the admin ports on that switch?? for example ports 1 - 12 are admin and set to PVID = 2 and all port are untagged, ports 13 - 24 are curriculum and set to PVID = 3 and all ports are untagged, if the BB feed is then set to PVID = 3 and set to tagged on each of the 3 VLANS what effect does this have on ports 1-12??

 

Me, I'd just get an old box and stick Linux on it. If you don't fancy that option, there's lots of nice second hand Cisco kit on ebay.

 

OK, i have a fair bit of old kit lying around what would need to be setup on linux for the routing and how many would I need, I currently has 10 Backbone switches and 40ish room switches all layer 2, with regards to the cisco kit got any models in mind??

[Geoff]

I agree but how does that affect the admin ports on that switch?? for example ports 1 - 12 are admin and set to PVID = 2 and all port are untagged, ports 13 - 24 are curriculum and set to PVID = 3 and all ports are untagged, if the BB feed is then set to PVID = 3 and set to tagged on each of the 3 VLANS what effect does this have on ports 1-12??

 

None.

 

OK, i have a fair bit of old kit lying around what would need to be setup on linux for the routing and how many would I need, I currently has 10 Backbone switches and 40ish room switches all layer 2, with regards to the cisco kit got any models in mind??

 

Even a creaky old Pentium 2 can keep up with gigabit traffic. So nothing amazing.

 

with regards to the cisco kit got any models in mind??

 

Again, nothing amazing, a bare bones 2600 series router will the apropriate Ethernet module will be fine for example.

[ICTNUT]

OK I seem to have a much clearer view of how this needs to be setup and will put together a plan for the end of term.

 

With regards to the routers where would these need to be placed?? and how many would I need <- I suppose this wouild depend on where the placement would be, I guess ;-|

[Geoff]

One should be sufficient, where ever you 'core' network is.

[ICTNUT]

OK will plan on getting a 2600 as these seem to be realtively cheap (approx £20 - £30).

 

What configuration changes to exisiting network setup will need to be made in order for the routing to be done correctly, as you may gues VLANS and routing are not my strong points.

 

Obvoiusly backbone switches will need to be told to forward all requests to the router and I guess this is changing the gateway IP to reflect the new router.

 

I am not going to go into router configs here but will need to hit that at some point.....

[Geoff]

You need to look at your IP subnets. Really, you want a 1 to 1 mapping of IP subnets over to VLANs. This'll make your routing easier. What IP range(s) have you got to play with?

 

You will need to change your gateway IP on all networking devices to reflect the new router. Otherwise they will be unable to communicate outside their VLAN.

[ICTNUT]

I am planning on putting in a new DHCP scope altogether.

 

Currently running 192.168.49.x -> 192.168.51.x with 192.168.0.x thrown in on a 255.255.0.0 subnet.

 

The plan is to setup a new super scope starting with 192.168.49.x on a 255.255.248.0 subnet giving 8 IP ranges with a total of 2048 addresses to play with.

 

This will allow for IP ranges to be allocated to set rescources i.e. 1 range for ThinClient, 1 range for Admin PC's etc.

[Joedetic]

I had written a few paragraphs about cisco routers and the appropriate configurations etc. Then the site refused to post anything or do anything so it lost it *anger*

 

Anyway...if you are going to get Cisco kit then the 2600 series is good. The 2610s are what i've got for doing testing on for CCNA. You can forward DHCP i believe, although i've never done it.

 

Beware of the difference between ethernet and fastethernet when buying them from ebay and whether they're single or dual ports. Also whether they come with the IOS or any WICs.

[ICTNUT]

@joedetic: I am currently looking at a 2610 with an IOS version of 12.3 which I beleive will handle in the inter VLAN routing that I need, I am awaiting a reply on the network interfaces and such so lets see what happens.

[Joedetic]

Are you familiar with configuring via the cisco IOS?

 

You've reminded me to power mine up to get some practice seeing as i've not done it in a few weeks and resume my CCNA in september.

[ICTNUT]

Yes to a degree, I used to have a couple of ISDN 800's at home bundling my ISDN lines prior to broadband and have since upgrade those for the ADSL equivalents.

 

Have not done any VLAN / DHCP routing but hey how can we learn if we don't play ;-)

[ICTNUT]

Just had a reply regardsing the 2610:

Hi, the 2610 comes with a 10mb Ethernet interface built in. Despite it being 10mb it is fully capable of 802.1q VLAN trunking. At £49, the router does not come with any extra WIC modules although these are available at extra cost. A WIC-1T serial module is £25, and a NM-4A/S 4x serial module is £45. Although the ebay listed router does not include any extras, I can throw in a power cable, console cable, and a CD full of Cisco training material if you buy today.

 

Do you know if the 10Mb units are upgradeable to 100mb???

[Joedetic]

They're build onboard. You can get modules for fast ethernet i believe but they're expensive. I've got a mate that looked into it.

 

If you're not going to connect more than one router then i dont see the need for the WIC cards. But i can recommend the new WIC-2T ones. They're relatively cheap on ebay and if you're housing them all in the same cab the short smart-serial cables are great

[Guest Guest]

Sorry to hijack thread

Are you familiar with configuring via the cisco IOS?

 

You've reminded me to power mine up to get some practice seeing as i've not done it in a few weeks and resume my CCNA in september.

 

Dynamips is a cisco router emulator. Wack a IOS in exactly the same as you would a real router. Map a virtual port to a physical nic and start forwarding traffic. Want to setup a virtual network? No problem.

 

http://www.ipflow.utc.fr/index.php/Cisco_7200_Simulator

 

Zebra is a real software router with commands very similar to cisco.

http://www.zebra.org/

[Joedetic]

That's all very well and good, but have you tried to get hold of a Cisco IOS legally? They're very expensive. And if it's a school you're going to want to use something that's not legally questionable, so using the IOS that comes wiht the router should allow you to do that.

[ICTNUT]

I am intrested in Zebra, I wonder how Geoff do his routing as he has just added and old linux PC and config'd that as a router.

 

I have alot of old kit lying around maybe this would be a better way to do this rather than trying to hunt down a cisco router.

 

Also, just popped into my mind, what about failover if the router dies, can we load balance these things or do we just need a second unit on stand by??

[Geoff]

I am intrested in Zebra

 

Zebra is a dead project, look at Quagga if you want a software router daemon for Linux that's actively developed.

 

http://www.quagga.net/

 

I wonder how Geoff do his routing as he has just added and old linux PC and config'd that as a router.

 

My router is really a firewall. I just get routing for free.

 

http://www.linuxjournal.com/article/5826

http://www.shorewall.net/Shorewall_and_Routing.html

[ICTNUT]

Right here goes, just ordered a Cisco 2651XM Dual 10/100 NICs with ISO version 12.8 IP Base for the Inter VLAN routing.

 

Let me see if I have this right in my head:

 

All devices will have thier gateway IP changed to show the router address and all requests will be sent to the router, the router then forwards on the DHCP requests to the DHCP server which should in theory provide the correct IP based on the sunbent the VLAN is in.

 

 

Hmmmm how does the router / dhcp server know this?? As far as I am aware the DHCP server looks for the soure address and then offers an IP address from the same range as the source address but if the request has been forwarded via the router is the source address not the routers address??

 

Or am I missing a trick here??

[Joedetic]

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00804412bf.html

 

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t2/dt_dhcpu.htm

 

Are those of any help?

[ICTNUT]

@Joedetic: This makes sense, set up the router with the relay agent and it "relays" NOT "forwards".

 

Cheers for the info !

[Joedetic]