Lan Extension: VLAN or Single Subnet HELP>>

[EN4CER]

Hello All,

 

I urgently need you guidance with this.>>> !

 

 

We currently run two servers, therefore domains split by a VLAN (two different subnets) for our Admin & Curriculum networks on one site.

 

A Lan Extension is about to be installed, to connect a new site 1.5km away. Virgin Media\Synetrix are doing the installation and

have now said the VLAN will not be re-created as there will only be 1xRJ45 port either end. This is against what they originally said, hence why we went the lan extension route.

 

They now suggest either getting someone to configurer a VLAN with segmented switches either end or going to a single subnet.

 

We are very unhappy, as we were lead to believe, the VLAN would be re-created as part of the install and that we would just be able to

plug back in our equipment and have the two sites connected and running as before!!

 

Can a knowledgeable person comment on any negatives in going to a single subnets, the enormity of the task and is this a better or worse option over getting

the VLAN re-configured.??

 

Time is not our friend on this!!

 

Any other comments greatly appreciated.

 

many many thanks in advance.

 

svan.

[Roberto]

What does your scope of work say with Virgin? Presumably you've specced this system to work how you wish, so if they've suddenly said that isn't how it's going to work then I'd tell them to do one, personally.

 

Can a knowledgeable person comment on any negatives in going to a single subnets

 

That very much depends on what problem you're solving by having more than one subnet in the first place. You're essentially maintaining two LANs, one for admin and one for curriculum right? That's not the way I'd do it these days, and you imply that you've only got one domain controller in each of the two domains and *that* would worry me a lot more than any possible security issues from a 'combined' LAN.

 

It's difficult to say for sure what work would be required to make this work the way you want, At the very least you're going to want switches on both ends that can route traffic onto the appropriate VLAN, and how much extra is needed on top of that is going to depend very much on the network config you have now.

[EN4CER]

Thanks for replying Roberto.

 

Yes Virgin said once the lan extension was in place it would be a matter of plugging in our ethernet switches and off we go. But not anymore!! They now suggest someone reconfigures the vlan and provides the necessary switches at each end or go to one subnet. I don't have the time to do either, nor want to do the latter. They said it should work out of the box and now are back tracking.. I think the single subnet is a cop out. !

 

We the school switches from LGFL 1 TO 2 they recreated the vlan, so don't understand why they don't want to do it from the lan extension? They say the kit that is being installed has only x1 RJ45 port... But thats not my issue.. well shouldn't be!

 

Can I asked, why yu would do the two domains, via a vlan? and why does having one DC in each domain worry you?

 

Regards

 

svan

[ChrisH]

If the equipment either end of this supports it, it just needs to be a trunk port so it carries both VLANs tagged, or I suppose one port of a switch either end could be the trunk that this "link" connects to. As you want to keep the traffic separate, you would not need to worry about a router or a layer 3 switch at each end. What will be the connection device at either end ?

[EN4CER]

At the main site there will be a Cisco 2951 G2 and a lan extension device of some sort at the other..

 

They have suggested that we provide 2 x 8 port switches and configure them, so you have 2 ports that are segmented at each end.

 

Surely, they should carry out the necessary configuration\kit so we can plug in Ethernet layer 2 switches, patch in and be off and running.

 

The whole set up was sold and plug and play!!

[ChrisH]

According to what they are saying the "LAN extension device" must be capable of carrying tagged traffic for both VLANs else they wouldn't suggest the two 8 port switches. Assuming some of your switches have ports in both VLANs at the moment you would just need to replicate the configuration of your uplink from that switch to another port that would connect to the "LAN extension device" so

 

Site 1 Existing Switch with Trunk Port > "LAN extension device" > Site 2 Existing Switch with Trunk Port

 

The port config on the switch would be something like

 

interface gi01/1
switchport mode trunk
exit

 

You would just need to make sure your switches fabric at either side were up to carrying the extra traffic else new switches.

Edited July 14, 2013 by ChrisH

[EN4CER]

Hi Chris, so are you saying we would need vlan ethernet swithes either end?

 

and

 

Would these switches need any technical configuration, or just plug in and go?

 

Thanks again

 

svan

[ChrisH]

Okay I misread the equipment list slightly but yes you will need a switch configured with VLANs at each end.

 

Port 1 Trunk from the router or LAN extension at the other end.

Port 2 Admin VLAN uplink to rest of network.

Port 3 Curriculum VLAN uplink to rest of network.

 

You will need to configure the switches but I can give you a config if you let me know what ports you are using (assuming Cisco).

Edited July 14, 2013 by ChrisH

[EN4CER]

Okay I misread the equipment list slightly but yes you will need a switch configured with VLANs at each end.

 

Port 1 Trunk from the router or LAN extension at the other end.

Port 2 Admin VLAN uplink to rest of network.

Port 3 Curriculum VLAN uplink to rest of network.

 

You will need to configure the switches but I can give you a config if you let me know what ports you are using (assuming Cisco).

 

Hi Chris, you have been very helpful.

 

So just so I'm clear in my mind. The new vlan switches either end will require some sort of technical configuration?

If this is the case, and as we were told the vlan would be set up and ready to go, I think we will lay the problem back with lgfl.

 

Many thanks mate.

 

Btw, do you think their suggested single subnet alternative is a bit of a cop out?

[ChrisH]

Yes they will require configuration because at the default configuration, all ports will be in the same VLAN. For this solution to work I am assuming that the traffic is being passed from that router or lan extension thingymebob with it's VLAN tag added. If this frame hits a port that is not configured to receive traffic from multiple VLANs (a trunk port) it will be dropped or just wont reach its intended destination.

 

The lack of ports complicates matters hence their 2 suggestions, I do however think that these days you should be operating on a single domain with the necessary security and multiple VLANs/subnets for traffic control and security, but this would depend on the size of your network and would require routers or layer 3 switches. If you want to talk further I am happy to talk on the phone tomorrow, pm me for my number if you would like to do this.

[EN4CER]

Thanks Chris, why is single subnet / domain over vlans and is that quite complex to configure?

 

 

The school has always operated on a vlan and it works well. As lgfl promised the vlan aka same set up would be in place with a lan extension, I feel they should see it through and make everything is in place, configured and working.. Don't you agree?

[twin--turbo]

What are the two Current switches at either end adn do they have a spare port?

 

We run SHDS ( what Lan Extension Services became about 4 years ago ( LES and EES are old terms ) across 5 miles , we don't actualy run vlans across it ( it's routed insted ) but that's because of poor install by the I.T. Contractor who did not do as we expected. It's not at all diffcult to do though if everythignis the same at both sites and you have a L3 switch at the core on each site.

 

Rob

[twin--turbo]

P.S.

 

Regardless of havign two domains, you probably want to implement vlans.

 

The two domains could exist on the same VLAN though, many schools droped the idea of a Physicaly separate ( or vlaned ) Curriculum/Admin network many years ago.

 

Rob

[EN4CER]

, many schools droped the idea of a Physicaly separate ( or vlaned ) Curriculum/Admin network many years ago.

 

Rob

 

Why Rob?

[twin--turbo]

In many instances when teachers got classroom PC's or teacher laptops they needed to use resources from admin and curriculum systems and although possible the complexity outweighed the risk of a single network, this became more true when they started using wifi laptops on old wi-fi systems without vlan abilities.

 

The main security weak point is the user that leaves their workstation logged in and left unattended.

 

Rob

[catch21]

At risk of resurrecting a dormant thread, it seems to me the contractors have extended a LAN for you as requested, as long as the kit they have used is vlan-aware and preserves vlan tags and untagged packets as is, which I am sure they will have. If not they have not delivered.

 

So you have a single RJ-45 at each end. Now you have to put a bit of kit there, why should they be responsible for that?

 

What if you had 17 vlans, would you want 17 RJ-45s at each end?

[EN4CER]

At risk of resurrecting a dormant thread, it seems to me the contractors have extended a LAN for you as requested, as long as the kit they have used is vlan-aware and preserves vlan tags and untagged packets as is, which I am sure they will have. If not they have not delivered.

 

So you have a single RJ-45 at each end. Now you have to put a bit of kit there, why should they be responsible for that?

 

ummm, because that's what they promised!

 

What if you had 17 vlans, would you want 17 RJ-45s at each end?

 

umm because that's what was promised!

[catch21]

umm because that's what was promised!

 

Then they would appear to be in breach of contract with a number of remedies available to you. You haven't settled the invoice yet presumably?

[EN4CER]

Then they would appear to be in breach of contract with a number of remedies available to you. You haven't settled the invoice yet presumably?

 

Thanks, no we haven't. They will be installing kit either end with two rj45s,so it should be plug in and go, as originally billed!

[catch21]

Thanks, no we haven't. They will be installing kit either end with two rj45s,so it should be plug in and go, as originally billed!

 

Right, and to your original question, (and I assume you mean your admin and curriculum networks are on two different vlans) I'd stick with that, why drop back to one? If you need crossover you can do that via static routes in a cheap router. The vlan configuration should be fairly straightforward.

[EN4CER]

Right, and to your original question, (and I assume you mean your admin and curriculum networks are on two different vlans) I'd stick with that, why drop back to one? If you need crossover you can do that via static routes in a cheap router. The vlan configuration should be fairly straightforward.

 

My thoughts exactly. I shouldn't need to do anything with the vlan setup, as they should recreate the existing vlans when they install the new kit!

[seawolf]

I think you may be confused about the difference between subnets and VLANs. Anyhow, you only need 1 LAN to have two VLANs. We have one LAN and 30 VLANs. It sounds as if you wanted two fibre cables (I assume fibre, maybe a Microwave link?) run to the other site for two separate networks. That would be more expensive than running one cable and using a switch on the other end to handle the VLANs, except I don't think you have VLANs, but actual two separate networks, therefore your problem.

 

If the contract said they would run two links then you shouldn't pay until you get two links. Although, I'm still a bit confused with the way your talking about VLANs, so maybe I'm misunderstanding.

[catch21]

I think you may be confused about the difference between subnets and VLANs. Anyhow, you only need 1 LAN to have two VLANs. We have one LAN and 30 VLANs. It sounds as if you wanted two fibre cables (I assume fibre, maybe a Microwave link?) run to the other site for two separate networks. That would be more expensive than running one cable and using a switch on the other end to handle the VLANs, except I don't think you have VLANs, but actual two separate networks, therefore your problem.

 

If the contract said they would run two links then you shouldn't pay until you get two links. Although, I'm still a bit confused with the way your talking about VLANs, so maybe I'm misunderstanding.

 

Ah yes, I had the same problem until I realised it was the same thing, 2 LANs or 2 Vlans over 1 LAN, same thing!

 

At the near end if there is one RJ45 then presumably this connects to a vlan-aware device such as a switch with a trunk carrying one tagged and one untagged or both tagged. Then it doesn't matter what is connected into other ports of this switch, two access ports on separate LANs or one trunk port carrying 2 vlans. See what I mean?

Edited July 31, 2013 by catch21

[seawolf]

Ah yes, I had the same problem until I realised it was the same thing, 2 LANs or 2 Vlans over 1 LAN, same thing!

 

At the near end if there is one RJ45 then presumably this connects to a vlan-aware device such as a switch with a trunk carrying one tagged and one untagged or both tagged. Then it doesn't matter what is connected into other ports of this switch, two access ports on separate LANs or one trunk port carrying 2 vlans. See what I mean?

 

What I meant was that it sounded like the assumption is that VLAN = Physical LAN, which it does not (therefore the VIRTUAL in VLAN). I think this has caused the problems with the supplier for the "LAN extension". They assumed VLANs meant VLANs and not two physical LANs. The customer and the vendor weren't speaking the same language.

[catch21]

You're right, there's a strange use of terms in the original post. I think we can see what the OP was getting at. Maybe the OP will update the thread as discussions with the installer and the installation progress.