Vlans & Windows DHCP server

[steele_uk]

I will be splitting my flat network into vlans in half term, and i am confused whether the following is possible.

 

I understand that i can use the equivalent of IP helper, or relay on the switches, but if i want my current windows 2008 server to be the DHCP server for different networks, do i need a specific NIC for each network that i want it to server IP's from, or is there a way of doing this from the a Single NIC on the server?

[ChrisH]

You only need one interface on your Dhcp server it knows what range to give out because of where the request originates from via your layer 3 switch or router.

[FN-GM]

You just have a standard server with 1 nic. Give it an IP on your server VLAN. Setup a scope for each VLAN the usual way.

 

To create a basic VLAN on a Cisco Layer 3 Switch.

 

en (might not be needed if already elevated)

Conf t

VLAN

Name

exit

exit (again)

 

To give the VLAN an IP address so it will route

 

en (might not be needed if already elevated)

conf t

int vlan

IP Address

IP helper-address

 

New VLAN is ready to go. Pretty simple when your used to it.

 

You might also want to create a Helper for any PXE boot server you have.

Edited January 15, 2014 by FN-GM

[steele_uk]

Awesome..cheers guys

[FN-GM]

If you need anything just shout

[twin--turbo]

One point of note..

 

Who looks after you broadband router? Will they make routing updates for your new vlan?

 

Rob

[DMcCoy]

One point of note..

 

Who looks after you broadband router? Will they make routing updates for your new vlan?

 

Rob

 

 

Router is the other side of the *local* firewall, surely? Only that firewall with need the routes.

[steele_uk]

The plan is to present all the Vlans/networks to the firewall (Palo Alto Pa500) and then Firewall to the BT router - No LEA involved

 

Quick side question, i will need to route between the vlans on the core Hp A5800, as some vlans need to see the servers, do i lose the gained vlan'ed security here, or is this where i make use of my firewall ACL's?

I am new to vlan routing, and whilst i understand why i can route between two different networks, i am not sure how inter vlan routing manages to pass traffic tagged from VLAN 1 to a server on Vlan 2

[DMcCoy]

VLANs without an IP interface will not be routed by the switch

VLANs with an IP interface will be routed by the switch, to another VLAN or to another route/default gateway (usually the firewall as default gateway).

 

VLANs that are routeable with an IP can have ACLs applied to the VLAN to allow/deny traffic between VLANs (5800 seems to support ACLs)

 

Clients will use the switches IP for that VLAN as their gateway which will then route the traffic to another vlan or to the firewall etc.

 

You need to think a bit about edge switching and how you are going to route traffic there, personally I preferred to have routing only done by the core switch, so intervlan traffic between edge devices had to go back to the core switch first, however this was minimal, most traffic was to/from the servers which were connected directly to the core, so all traffic had to go there anyway.

 

Other things to look into vlan tagging for edge switches, IGMP filtering and querier. Also spanning tree and root priorities.

[steele_uk]

Your a star...cheers.

 

Hopefully i can knock a plan up and see what you guys think.

[LukeTitmus]

Essentially the routed switch (The switch with the IP addresses for each VLAN) will respond to the ARP requests, the data will be sent to the virtual interface with in that switch for the VLAN, this switch will then send out another ARP request on the subnet it is trying to reach, when it receives the response the data is tagged on the new VLAN and sent out the correct physical interface towards the receiving device.

 

The reason you use VLAN's is to reduce the size of the of the broadcast domains