J_Worth Posted March 3, 2014 Posted March 3, 2014 Hello everyone, We are currently looking at VLANning our school network, and have a couple of questions. First off, I will state what VLANs we want: VLAN 5 - INTERNET_FEED VLAN 10 - SERVERS VLAN 20 - CURRICULUM VLAN 30 - ADMIN VLAN 40 - iMACS VLAN 50 - CASHLESS VLAN 60 - WIRELESS VLAN 99 - MANAGEMENT So, my questions are: 1). Does VLAN 1 (Default) need to be used and should it be untagged on the switch uplinks? 2). For the INTERNET_FEED VLAN, it will consist of a /30 network with one IP on the SVI of the Layer 3 and the other IP on the pfSense box. Is this a viable solution to allowing all VLANS access to the internet? 3). For our Wireless APs (Aruba AP-105) do those links need to be Trunk (Tagged)? What about setting IP addresses on the APs themselves? How would they be able to use an IP in the MANAGEMENT VLAN range? I hope the above makes some sense.
seawolf Posted March 3, 2014 Posted March 3, 2014 Hello everyone, We are currently looking at VLANning our school network, and have a couple of questions. First off, I will state what VLANs we want: VLAN 5 - INTERNET_FEED VLAN 10 - SERVERS VLAN 20 - CURRICULUM VLAN 30 - ADMIN VLAN 40 - iMACS VLAN 50 - CASHLESS VLAN 60 - WIRELESS VLAN 99 - MANAGEMENT So, my questions are: 1). Does VLAN 1 (Default) need to be used and should it be untagged on the switch uplinks? 2). For the INTERNET_FEED VLAN, it will consist of a /30 network with one IP on the SVI of the Layer 3 and the other IP on the pfSense box. Is this a viable solution to allowing all VLANS access to the internet? 3). For our Wireless APs (Aruba AP-105) do those links need to be Trunk (Tagged)? What about setting IP addresses on the APs themselves? How would they be able to use an IP in the MANAGEMENT VLAN range? I hope the above makes some sense. I would create a NETWORK or SWITCH VLAN rather than an INTERNET vlan. You will want your switches, routers, firewalls, APs, and web filters to all to be untagged be on the NETWORK vlan. Your WiFi APs should be untagged on the NETWORK VLAN and tagged on all of the VLANs used for any WLANs (SSIDs). 1
FN-GM Posted March 3, 2014 Posted March 3, 2014 1) It is recommended not to use it. Uplinks would be trunk ports anyway so this wouldn't apply. 2) What side of the PFsense will it be? Is it the internal network? 3) Not 100% but i think they will be trunk yes. You will set an IP on them individually and configure them to use a specific VLAN for management.
rob_coles Posted March 3, 2014 Posted March 3, 2014 Hello everyone, We are currently looking at VLANning our school network, and have a couple of questions. First off, I will state what VLANs we want: VLAN 5 - INTERNET_FEED VLAN 10 - SERVERS VLAN 20 - CURRICULUM VLAN 30 - ADMIN VLAN 40 - iMACS VLAN 50 - CASHLESS VLAN 60 - WIRELESS VLAN 99 - MANAGEMENT So, my questions are: 1). Does VLAN 1 (Default) need to be used and should it be untagged on the switch uplinks? 2). For the INTERNET_FEED VLAN, it will consist of a /30 network with one IP on the SVI of the Layer 3 and the other IP on the pfSense box. Is this a viable solution to allowing all VLANS access to the internet? 3). For our Wireless APs (Aruba AP-105) do those links need to be Trunk (Tagged)? What about setting IP addresses on the APs themselves? How would they be able to use an IP in the MANAGEMENT VLAN range? I hope the above makes some sense. 1. It's recommended. 2. not sure about that one. 3. If you are pushing more than one vlan down your ap's they would need to be trunked. Also, We used location based vlan's/ eg IT Suite, Upper School, etc etc, and then Guest Wifi internal etc etc.
FN-GM Posted March 3, 2014 Posted March 3, 2014 @rob_coles why would you be using an access port tagged to VLAN 1 and not trunks for uplinks?
rob_coles Posted March 3, 2014 Posted March 3, 2014 It was something I read while implementing vlan's on our site. VLAN Security White Paper [Cisco Catalyst 6500 Series Switches] - Cisco Systems
FN-GM Posted March 3, 2014 Posted March 3, 2014 It was something I read while implementing vlan's on our site. VLAN Security White Paper [Cisco Catalyst 6500 Series Switches] - Cisco Systems Sorry I miss read the OP. I thought they where saying leave it tag not untag it. In that case we are on the same page
chazzy2501 Posted March 3, 2014 Posted March 3, 2014 Hey, can I tack a question on. These are logical VLANs does anyone use geographic VLANs?
seawolf Posted March 3, 2014 Posted March 3, 2014 Yes, we use both logical and geographical VLANs. We have at least two VLANs per building one for desktops and one for VoIP phones. In buildings with computer labs we have a VLAN per lab as well. We have 13 buildings. The we also have the logical VLANs such as network, server, admin, backup, printer, and multiple WiFi VLANs.
FN-GM Posted March 3, 2014 Posted March 3, 2014 Hey, can I tack a question on. These are logical VLANs does anyone use geographic VLANs? We don't use geographic. For client VLAN each stack has one or the bigger stack that has 2. No client VLAN exists on more than 1 stack. For many cases the stacks are hosted in geographic points, so it would work out that way, but one hub room has 2 stacks so doesn't work out there.
J_Worth Posted March 3, 2014 Author Posted March 3, 2014 2) What side of the PFsense will it be? Is it the internal network? It will be the internal (LAN) side. Something like this: Layer 3 Switch --> pfSense --> LEA Router The layer 3 switch will have a SVI of 10.10.255.253/30 and pfSense LAN interface will have 10.10.255.254/30 The layer 3 switch will have a default route of: 0.0.0.0 0.0.0.0 10.10.255.254 The pfSense box will have static routes back to the individual VLAN subnets. For example: 10.10.10.0 255.255.255.0 10.10.255.253 I have set this up using Cisco Packet Tracer by configuring a router to use NAT (to loosely emulate the pfSense box) and it works as expected, but I wasn't sure if it is the best way to do this. Thanks. Sent from my iPhone using EduGeek
J_Worth Posted March 3, 2014 Author Posted March 3, 2014 3) Not 100% but i think they will be trunk yes. You will set an IP on them individually and configure them to use a specific VLAN for management. Having looked through some Aruba forums, it would appear that you set the ports for the APs to be untagged on a specific VLAN (VLAN 60) and then other VLANs can be tunnelled down through that VLAN. Therefore, the AP gets an IP address within the subnet for VLAN 60 but the SSIDs can be on different VLANs and the controller is connected to the layer 3 switch as a trunk. This probably explains it much better than I have above: Multiple VLAN setup with AP 105's - Airheads Community
localzuk Posted March 3, 2014 Posted March 3, 2014 Hey, can I tack a question on. These are logical VLANs does anyone use geographic VLANs? Yup, we have both. We have geographic ones for ICT suites (to allow for broadcast based imaging), and logical for everything else.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now