I don't think I understand VLANs

[catch21]

I have read "you cannot configure two vlans with the same IP address range".

 

Why not? I thought the whole idea of vlans was to effectively implement two networks on one switch, by the addition of tags containing a vlan id?

 

So why can't I have red 192.168.0.0/24 on vlan 10 and blue 192.168.0.0/24 on vlan 20?

 

I know there's a good reason, but I can't figure it out at the moment.

[plexer]

Would it be because a device could route between vlans and thus that would fail?

 

Ben

[ConradJones]

as @plexer says technically you could configure two vlans with the same ip range as long as you aren't trying to route between them, but more you should ask the question why would you? if you did have two completely seperate network segments it would better to have different ip ranges so it was obvious which one you were on, although it could have its uses in testing or lab environments.

[ADMaster]

You can do that as long as you do not configure the IP on the switch, a switch is a layer 2 device and doesn’t care about IP’s (layer 3).

The ip you configure on a switch is used for management purposes, not what IP range the connected machines have. You can configure the red and blue machines with the same address and they will not be able to communicate with each other, but in this case they will each need their own router.

A single router would not be able to have overlapping IP addresses.

In theory you may be able to set the IP address with a /32 so the router thinks they are different networks, and each vlan would have to use a different gateway. I think it would still cause routing problems though.

If this a just what if scenarios for your knowledge by all means play around and try the /32 and perhaps something with sub interfaces. If this is production use separate addresses and use an ACL on the router if you don’t want them to communicate.

 

In my school I use vlans to segment and identify the network, not to use the same address. I have separate vlans for wireless, voip, data, security etc. I have multiple data vlans for a couple reasons, 1 to breakup broadcast domains, and 2 for troubleshooting and identification. Each data closet is on its own data vlan. This allows me to know at a glance what part of the building that IP is coming from.

[catch21]

Thanks. It's the point of convergence of the networks that causes the conflicts then. I hadn't quite got to that part - clearly!

 

This isn't exactly hypothetical. I'm a facilities manager with a background in the field but my knowledge is somewhat out-of-date. I've just installed a new wifi network and just coming back up to speed. Next is to upgrade the switch core.

 

For some reason I haven't been able to figure out, we are told what IP address range to have on the private side of our network by our broadband/service provider. They also provide firewall and filtering so our delightful children do not download anything that might shock the teachers and I'm guessing this might have something to do with the restriction.

 

Up to now we have been issued with a /24 address i.e. 256 hosts and I considered this may not be enough (!) with the explosion of mobile devices that is just hitting us out here in the sticks. (We're not really at the cutting edge of technology here.)

 

Our new address range is /22 i.e. 1024 hosts, or 1022 if you exclude the reserved ones. With nearly 500 children and 40 permanent FT or PT members of staff I guess this'll do us for a few more months.

 

With the new vlan-aware capabilities of the ethernet switches I am planning, I'm trying to figure out how (even if) to partition the network. The new wifi is ruckus ZD1100 and 7636 APs incidentally.

 

I guess where I am at is that if I am partitioning the local network into vlans I will be splitting the host id part of the IP address, but then all hosts would have to share the same DHCP server etc, so I don't see how it will all fit together?

Edited March 29, 2013 by catch21

[ADMaster]

Your isp only allowing you 1024 addresses doesn’t leave you much room to segment the network. In my case we are told what private IP’s to use as well, but that is from our ITC and we have networking between other schools in the consortium, they also do firewall and filtering for us. However I have a full class B to work with.

I could easily put the ip rage they assign me on the router and use anything I wanted internally, I just wouldn’t get all the benefits such as filtering by IP range etc.

 

You should be able to tell the ISP what you want to use internally, however if it is a LEA/ITC that might be a different story.

 

If there is no advanced filtering by IP or different filters for staff and students, I’d NAT what they give me and use my own IP ranges.

 

For the DHCP issue on the router under the vlan interface you set the IP helper address to the IP of your DHCP server. Then you setup the different scopes on your DHCP server. It took me a while to wrap my head around that one too.

[geezersoft]

You are out of your depth. If you want good honest advice, get some external consultancy. Your network is the very foundation upon which all services are delivered. It is just not worth getting it wrong.

 

Sit with the consultant and design what you want your network to do now and planned growth for the next 3 years. Learn from the consultant and in your own time go and study for your CCENT.

 

You will not regret it.

Edited March 29, 2013 by geezersoft

[catch21]

I'm sure you're right, but I'm quite a strong swimmer

[geezersoft]

A vlan can be considered a broadcast domain. So reasons for using more than one vlan are fundamenally the same as why you would use more than one subnet on your network.

 

PS: the RNLI has to rescue hundreds of strong swimmers each year.

[twin--turbo]

You need to take control of your internet router so that your not limited by the ISP.

 

Rob

[cpjitservices]

Would Subnet Zero not work here, you could use the same IP but put both IP's on a different subnet.... That would work.... Wouldn't it ?