Size of VLANS

[FN-GM]

Hi,

 

When creating multiple VLANs for clients, purely for the purpose of cutting down broadcast and segmentation (for example if something start flooding a vlan causing problems or a dodgy DHCP) how many clients do you put in each VLAN please?

 

Its just for a size really not locations etc

 

Thanks

Edited April 3, 2013 by FN-GM
more nfo added

[DMcCoy]

I usually did /24 but mostly machines were grouped by type and area, some core vlans and individual ones for each switch for student machines connected to it.

[FN-GM]

Thanks, do you usually fill up all of the /24 vlans?

[synaesthesia]

We're making sure there won't be any problems with the existing ones we're currently setting up - so we have a couple of /25s for misc bits, most of them are /24s, each of our sites are /22s and our wireless inc guest is a /20.

We won't be running out this time! /shakes fist!

[DMcCoy]

No, but I didn't have to worry about large numbers of wireless devices at the time, it may be better to have a slightly larger subnet for that vlan. For rooms/trolleys/admin/teaching it's usually fine.

[cpjitservices]

For Management VLANS we usually use a subnet for the correct number of devices +10 for expansion, same for the servers VLAN although generally these days we use /24's on server VLANs, PC VLANs we make the same size as users, if we had so many users and machines we would create VLANS with the right subnet size for users. Guest wifi is /28.

 

We manage fine, Makes it easily manageable.

[nicholab]

Does anyone use variable length sub-net masking for their Vlans?

[Destinova]

Some would argue that your vlans should not extend past the local switch.

[nicholab]

That would mean that every switch cab would need an L3 switch. I used that design before but with each cab on /24 and routing at the centre on a hp 4108gl.

[SYNACK]

Some would argue that your vlans should not extend past the local switch.

 

And they may be missing the point, as above this would require L3 at every cabinet or at the least multiplying the backhaul links by the number of VLANs.

 

The size depends on what kind of broadcast domain your system can cope with and what kid of isolation you want. We break stuff up into smaller subnets to limit broadcast domains - making bandwidth usage a little more efficient which can be big on wireless. It also helps limit certain attack and fault vectors like loopbacks and ARP poisoning.

 

There can be additional security concerns using VLANs for isolation if you have trunked ports out in the open but the benifits almost always outweigh the risk.

[CyberNerd]

Most of the decent switches are L3 anyway, and it does make a good deal of sense. Some would even argue that the uplinks should be OSPF VLAN's of their own (ie a vlan of 2). There isn't any point in polluting uplinks with random traffic that doesn't need to be there. I've got 4 links like this and it works pretty well.

[SYNACK]

Most of the decent switches are L3 anyway, and it does make a good deal of sense. Some would even argue that the uplinks should be OSPF VLAN's of their own (ie a vlan of 2). There isn't any point in polluting uplinks with random traffic that doesn't need to be there. I've got 4 links like this and it works pretty well.

 

If you can afford switches like that, if you are looking mid range most are the old school type of basic routing and not layer 3 bridging so you get some hefty penalties on traffic speed and latency. It also depends on how big your system is, we ahve a 5412zl at the core that happily does all the layer 3 bridging, we could have the lesser 2900 series do it but their featureset is way more limited and it just makes more sense to do it at the core. Almost all of our traffic traverses back to the core anyway so the traffic patterns are not markedly different. If our resources were much more distributed then a different structure may be benificial.

[apeman]

Most of the decent switches are L3 anyway, and it does make a good deal of sense. Some would even argue that the uplinks should be OSPF VLAN's of their own (ie a vlan of 2). There isn't any point in polluting uplinks with random traffic that doesn't need to be there. I've got 4 links like this and it works pretty well.

 

We have a setup like this (Very dense Layer 3 to the Edge) each switch has 5 to 10 vlans for various services and also additional vlans for OSPF uplinks. All service vlans are /24 and OSPF vlans are /30 (if i remember correctly)

I must say this setup is a pain in the A*se to admin and wireless clients hate it as they are constantly roaming and changing IP.

[CyberNerd]

If you can afford switches like that, if you are looking mid range most are the old school type of basic routing and not layer 3 bridging so you get some hefty penalties on traffic speed and latency. It also depends on how big your system is, we ahve a 5412zl at the core that happily does all the layer 3 bridging, we could have the lesser 2900 series do it but their featureset is way more limited and it just makes more sense to do it at the core. Almost all of our traffic traverses back to the core anyway so the traffic patterns are not markedly different. If our resources were much more distributed then a different structure may be benificial.

 

I think it's good practice to keep data, that doesn't need to be there, away from the uplinks and the core; even if that comes at a cost of overall switching capacity. The caveat would be if there was a lot of traffic that needs to go between the PC's, which is rarely the case.

 

It does sound like I'm running a much bigger network with over 50 switches and 80 AP's. 4x A5800's on the core. A mix of 4800's and 5500's at the near edge (where I do the majority of OSFP routing) and a mix of 3600SI 5120 SI and (mostly) 4500's at the edge and a sprinkling of 4500G POE's.

[CyberNerd]

I must say this setup is a pain in the A*se to admin and wireless clients hate it as they are constantly roaming and changing IP.

 

I actually find it easier to admin - the reason being is that it is far easier to diagnose a problem with/in a discrete network than one where traffic is going through multiple switches. We've got a MERU setup, and wireless clients don't even notice the difference if they go between different AP's

Edited April 4, 2013 by CyberNerd

[SYNACK]

I actually find it easier to admin - the reason being is that it is far easier to diagnose a problem with/in a discrete network than one where traffic is going through multiple switches. We've got a MERU setup, and wireless clients don't even notice the difference if they go between different AP's

 

Why stop there then, multiple links between multiple points BGP and/or IS-IS would probably allow for better link utilisation in that format. I can see how this could be more effective if lots of your traffic stays within the cabinet, being cloud based I'd imagine that most of your traffic would be going via the core to the net. Given the overhead of the routing protocols it may work out even. Separate subnets are easier to diagnose we just put them in different places.

[nicholab]

I once got told of that I had broken my network into too many subnets by a network consultant and that one subnet was fine for 600-800 machines. I did get the hp 4108gl running out of steam for routing.

[Mr.Ben]

I use /24's for the bulk of my areas and /25's for the ones that are 'small' (less than 30 devices). Management is split into smaller subnets /25 and /26 and the guest network is a /22

[apeman]

I actually find it easier to admin - the reason being is that it is far easier to diagnose a problem with/in a discrete network than one where traffic is going through multiple switches. We've got a MERU setup, and wireless clients don't even notice the difference if they go between different AP's

 

To be fair its very rare we have a problem on the network, when we have i wouldn't of said the layer 3 to the edge helped us narrow down the problem but thats purely down to the nature of the problems we had.

 

I agree any wireless system that tunnels traffic through a controller will work fine on a layer 3 network as your basically creating a virtual layer 2 network for wireless traffic, but you do take a performance hit.

[SYNACK]

I once got told of that I had broken my network into too many subnets by a network consultant and that one subnet was fine for 600-800 machines. I did get the hp 4108gl running out of steam for routing.

 

Depends on the implementation and what you are trying to achieve, if your system has robust enough routing with large route/switch mapping table and layer 3/4 bridging meaning it only has to route once then it handles it just like switch traffic bridging it. It cuts down CPU use and removes the penalties in speed as it is just as quick as local switching but with all the benefits of routing. This is what I was talking about with regard to solid layer 3 switching earlier.

 

There is too much but it depends on your situation. If you are dealing with every user being an active threat then a subnet per user is not excessive but almost no one is in that situation. As with everything it all depends on the situation. Some of this may change with IPv6 too.

Edited April 4, 2013 by SYNACK

[Duke5A]

I manage seven buildings interconnected with private fiber at 1GB link speed with a Cisco 6506 at the core. Most of my subnets are /23 and each building handles about five or six VLANs. There certainly isn't 510 wired devices in each elementary, but we purposely doubled the subnet size so we could split it across two DHCP servers. Have one server hand out addresses for the bottom part of the sub, the second for the top half. The only problem I've had with broadcast traffic was with some phone equipment and LAN School when it was looking for clients. The solution was to make a flat /24 VLAN across the entire district and place the phone equipment on it.

[Destinova]

It's actually fairly standard design, and you don't need an L3 switch in every cabinet. The L2 vlan only has to be present on the switch - it doesn't get assigned to any ports, just tagged across your trunks and pruned where necessary.

 

Does that mean the vlan extends past the local switch? Technically perhaps, but the point being you have eliminated the broadcast issue which is the point.

 

If you have L3 switches, great, use them, I'd say there's no point in buying L2 only switches these days anyway, the additional cost is minimal.

 

Hell, HP is offering buy 2 get 1 free on their 2900 switches.

 

Your L3 gateway can still be at your distribution layer - where it should be, not at your core, unless you are a smaller environment running a collapsed core in which case go right ahead.

[Destinova]

I must say this setup is a pain in the A*se to admin and wireless clients hate it as they are constantly roaming and changing IP.

 

I'd make this the exception. Your APs are switches, treat them as such and connect via trunks using their own subnet (per SSID). That subnet doesn't change and exists as a L2 vlan on any switch connected to an AP. No access ports using this vlan, so broadcast isn't an issue and your AP's should limit client broadcasts anyway if it's decent gear.

[SYNACK]

Does that mean the vlan extends past the local switch? Technically perhaps, but the point being you have eliminated the broadcast issue which is the point..

 

Yes that means it does extend past the local switch and that is the point, it is how many networks are setup and that is fine.

 

If you have L3 switches, great, use them, I'd say there's no point in buying L2 only switches these days anyway, the additional cost is minimal.

 

Hell, HP is offering buy 2 get 1 free on their 2900 switches.

 

Maybe in Canada but we get ripped apart on pricing so it can easily be double and the low end l3 stuff is not really worth having anyway. It would be nice to be given effecivly free hardware but the corporate overloards deam us to be a market that they wring every last drop of cash out of so they can afford a few more olympic sized pools for their homes.

 

 

Your L3 gateway can still be at your distribution layer - where it should be, not at your core, unless you are a smaller environment running a collapsed core in which case go right ahead.

 

Indeed, colapsed core is fine and the right solution for smaller networks, we only have about 400-500 clients so the three layer design is not nessisary.

[Destinova]

Yes that means it does extend past the local switch and that is the point, it is how many networks are setup and that is fine.

 

 

 

Maybe in Canada but we get ripped apart on pricing so it can easily be double and the low end l3 stuff is not really worth having anyway. It would be nice to be given effecivly free hardware but the corporate overloards deam us to be a market that they wring every last drop of cash out of so they can afford a few more olympic sized pools for their homes.

 

 

 

Indeed, colapsed core is fine and the right solution for smaller networks, we only have about 400-500 clients so the three layer design is not nessisary.

 

Only the L2 vlan extends past the local switch. This is fine. Design and security suggests you want to avoid broadcast - this does that.

 

If HP is ripping you off in the UK then look to Cisco. First, their gear is superior and their warranty now matches HP's completely. The only hope HP has ever had in the networking space has been on price, and if they aren't doing that for you, tell them to stuff it.