WAN Redesign Questions

[larry22]

Okay, we have a Fiber WAN now through our ISP connecting 4 schools in hub and spoke. Everything is working fine now with the config you will see below. However, this summer I want to have our 5412zl do all the routing for all the schools. The way it is set up now is that I have a 5412zl (config below) but I have a switch at each school doing routing for their school (2910al's). I'm using roughly 2-5% CPU usage on the 5412zl and I figured it would be more efficient to "dumb down" the switches at the other schools and have the 5412zl handle all the routing for all the VLANs at all the schools. As you will see, I have already set up the VLANs for all the schools and added the ip helper-address for DHCP. Before I go any farther I want to know:

 

1) Since none of the VLAN ports from the other schools (ABS, HES, WS) are tagged on this switch, can I add the IPs or will that screw anything up?

 

2) Then, when I'm ready, I can A) tag all the VLANs on the port that the ISP fiber is plugged into, B) turn off routing on all the other switches at the other schools, C) turn off the default route at each of the "core" 2910's at the other school, D) shut down VLAN9 Inter-School VLAN, and E) REMOVE all those static routes I added on the config below, correct?

 

Here is the config:

 

HP-E5412zl# show config

 

Startup configuration: 128

 

; J8698A Configuration Editor; Created on release #K.15.07.0008

; Ver #02:1b.2f:36

 

hostname "HP-E5412zl"

time timezone -300

time daylight-time-rule Continental-US-and-Canada

module 1 type J9538A

module 2 type J9538A

module 3 type J9536A

module 4 type J9154A

module 5 type J9534A

module 6 type J9534A

module 7 type J9534A

module 8 type J9534A

module 9 type J9534A

ip default-gateway 10.1.2.50

ip routing

vlan 1

name "DEFAULT_VLAN"

no untagged A1-A8,B1-B8,C1-C22,D1-D2,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24

no ip address

exit

vlan 3

name "Mirror"

untagged E1,E3

no ip address

exit

vlan 9

name "Inter-School"

untagged I24

ip address 10.9.1.1 255.255.255.0

exit

vlan 110

name "Chromebooks"

ip helper-address 10.1.2.2

ip address 10.11.0.1 255.255.254.0

tagged A1-A4,A6-A8,C1-C4,G5,G13,I2,I22

exit

vlan 15

name "School A Public WLAN"

ip helper-address 10.1.2.2

ip address 10.15.0.1 255.255.252.0

tagged A1-A4,A6-A8,C1-C4,G5,G13,I2,I22

exit

vlan 10

name "School A LAN"

untagged A5,B1-B8,C5-C22,E2,E4-E24,F1-F24,G1-G4,G6-G24,H1-H24,I1,I3-I21,I23

ip helper-address 10.1.2.2

ip address 10.1.2.51 255.255.254.0

tagged A1-A4,A6-A8,C1-C4,D1-D2

exit

vlan 20

name "School A Staff WLAN"

untagged C1-C4,G5,I22

ip helper-address 10.1.2.2

ip address 10.2.0.1 255.255.254.0

tagged A1-A4,A6-A8,G13,I2

exit

vlan 11

name "School A Student WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 50

name "School C LAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 30

name "School B LAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 40

name "School B Staff WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 60

name "School C Staff WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 70

name "School D LAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 80

name "School D Staff WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 12

name "School B Student WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 13

name "School C Student WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 14

name "School D Student WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 16

name "School B Public WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 17

name "School C Public WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 18

name "School D Public WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 19

name "Central Office Public WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 90

name "Central Office LAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 100

name "Central Office Staff WLAN"

ip helper-address 10.1.2.2

no ip address

exit

vlan 102

name "Central Office Student WLAN"

ip helper-address 10.1.2.2

no ip address

exit

mirror 1 port E3

timesync sntp

sntp unicast

sntp server priority 1 96.47.67.105

ip route 0.0.0.0 0.0.0.0 10.1.2.50

ip route 10.3.0.0 255.255.254.0 10.9.1.3

ip route 10.4.0.0 255.255.254.0 10.9.1.3

ip route 10.5.0.0 255.255.254.0 10.9.1.2

ip route 10.6.0.0 255.255.254.0 10.9.1.2

ip route 10.7.0.0 255.255.254.0 10.9.1.4

ip route 10.8.0.0 255.255.254.0 10.9.1.4

ip route 10.9.0.0 255.255.255.0 10.9.1.5

ip route 10.10.0.0 255.255.255.0 10.9.1.5

ip route 10.10.2.0 255.255.255.0 10.9.1.5

ip route 10.12.0.0 255.255.254.0 10.9.1.3

ip route 10.13.0.0 255.255.254.0 10.9.1.2

ip route 10.14.0.0 255.255.254.0 10.9.1.4

ip route 10.16.0.0 255.255.254.0 10.9.1.3

ip route 10.17.0.0 255.255.254.0 10.9.1.2

ip route 10.18.0.0 255.255.254.0 10.9.1.4

ip route 10.19.0.0 255.255.255.0 10.9.1.5

interface A5

monitor all both mirror 1

exit

interface E1

monitor all both mirror 1

exit

primary-vlan 10

no autorun

no dhcp config-file-update

no dhcp image-file-update

password manager

password operator

[njc235]

Why would you want to increase the traffic into your 'core' location? If individual schools do their own routing then only traffic destined for other schools needs to cross those boundaries. We now have schools in the UK who are not only routing within individual schools but some are routing in their own edge cabs. Whilst it may be overkill for some establishments to go this far it is highly efficient and most importantly, robust.

[larry22]

Okay, so the way I have it set up now (without all those extra VLANs I'll promptly delete trying to do a stretched layer 2) is good? Is that best practice?

[njc235]

Although the stretch layer 2 method is simple and easy to implement, it would be a step backwards if you have many users connected to each of your spokes.Traffic flow will be controlled more effectively if you use layer 3 routed links with routes to each destination.