nathan Posted June 11, 2014 Posted June 11, 2014 I've never actually used a VLAN and we're running out of IP addresses and so thought it would be good to learn and implement them. I know the basics of them but have a question. I have a unifi wireless system where i would like the guest access to be completely separate to the main network with it's own range and DHCP server. We can have a VLAN setup up on our managed draytek router that just goes straight out to the internet. This would feed into out main switch that i would also tag this port. I would also need to set the guest ssid to the matching VLAN tag within the Unifi software. Would i need to the rest of the switches in the building to be layer 3? or would the fact I've tagged the traffic for the access points be ok?
caffrey Posted June 11, 2014 Posted June 11, 2014 Doesn't have to be layer 3, but you need to have switches that support tagging (ieee 802.1q) like netgear layer 2+ else the traffic can't get from switch to switch. How you do this depends on switch type / make and the type of vlan you want to create.
Oaktech Posted June 11, 2014 Posted June 11, 2014 Everything you have said is correct, but you will also need to tag the vlan to the ports the Unifi are connected to to ensure they turn up at the access point.
mrforgetful Posted June 13, 2014 Posted June 13, 2014 Forget vLANs unless you have a need to implement them for security or network segmentation reasons. They add complication and overhead to all network traffic. Why not just change your subnet? We're on 255.255.224.0 which gives us 4000 IP addresses. There's no need to fiddle with tagging ports, making sure you've connected devices with static IPs into the correct port or anything like that.
synaesthesia Posted June 13, 2014 Posted June 13, 2014 No they do not really add complication, the benefits of separating VLANS outweight the overheads - especially if you need 4000 IPs.... If you want to worry about overhead, take a look at wireshark and see how much crap all your printers spout over your network and tell me vlanning them off wouldn't be a huge benefit!
themightymrp Posted June 13, 2014 Posted June 13, 2014 Agreed, with a network of that size the broadcast traffic would be outrageous! VLAN's are worth the extra bit of time to setup. It also future proofs you for things like VoIP and video streaming if your school heads down these routes.
mrforgetful Posted June 13, 2014 Posted June 13, 2014 I don't use them silly, it was just an example of if more IPs is the only reason you're looking at them, then it's not the only solution.
Stuclark Posted June 13, 2014 Posted June 13, 2014 VLANs aren't just for security. They're very useful methods of splitting up network traffic to make the network as a whole more managable. VLANs are definitely worth the small extra overhead on network switches and the extra configuration you'll need to implement them. The key though, is designing your VLAN structure sensibly. We have 25 VLANs on our network, mainly because we have over 100 Apple TVs, and the amount of Bonjour traffic they generate means we have to split the network into multiple small segments. If you've ever tried using more than about 10 Apple TVs on the same LAN, you'll know what I mean.
localzuk Posted June 13, 2014 Posted June 13, 2014 VLANs are useful for many reasons, but that's somewhat off topic here. To successfully use VLANs on a network you need layer 2 switches that support 802.1q, and something to do inter-vlan routing. This can either be a discreet router or a layer 3 switch which supports routing. I use an HP Procurve 5406zl for the routing stuff here. The setup for the wifi would be, on the switch port the AP is plugged in, untagged for the admin vlan (ie. the vlan which contains the IP address of the AP), and tagged for any VLANs which are used for specific wireless networks. Then in your wireless config, you assign the SSID to the VLAN number. The core or router would then have routing enabled, to allow traffic to traverse the network from the originating VLAN to any destination VLAN. Those rules can be as wide as "allow everything" (which you'd use for internal network VLANs) or "allow only access to this IP address on this port" which you'd use for guest wireless.
synaesthesia Posted June 13, 2014 Posted June 13, 2014 It's also prudent to think ahead. If you need to make changes to your network anyway, you might as well set yourself up for the future otherwise you'll just make more work for yourself. We needed to expand our IP allocation (gave ourselves 8000 - slight overkill but semeed to make sense, given the following assumptions: Every pupil has a device (smartphone) and the possibility of a 1:1. Not probably, but possible. Every staff member has a device (smartphone) and the possibility of a school provided device. Around 100 wirelessly connected devices on top of those. Possibility and probability are different things, and by working to what is possible, we are very well set for the future, whatever it brings. There was a learning curve getting vlans and subnets in place but very, very well worth it.
caffrey Posted June 13, 2014 Posted June 13, 2014 Another example, I just created a 5 port switch within a 24 port switch for WAN using VLANS
nathan Posted July 10, 2014 Author Posted July 10, 2014 (edited) Thanks for all the replies. I'm a little confused at the moment. We have 15 unifi access points. For these access points we can setup different SSIDs and tie them to different VLANS. If i tag the ports that these access points feed into which VLAN do i use? As an example: We have a guest wifi and our main school wifi. If the guest wifi ssid was set to vlan10 what would we set the port on the switch too so the main school ssid still worked? or can you set ports to more than one vlan? Edited July 10, 2014 by nathan
localzuk Posted July 10, 2014 Posted July 10, 2014 The "management VLAN" should be untagged. Then all the VLANs for the wireless SSIDs would be tagged.
Oaktech Posted July 10, 2014 Posted July 10, 2014 Thanks for all the replies. I'm a little confused at the moment. We have 15 unifi access points. For these access points we can setup different SSIDs and tie them to different VLANS. If i tag the ports that these access points feed into which VLAN do i use? Each one that exists on the Unifi as a SSID. For example we currently have 2 ssid, one is a guest with DHCP provided by the firewall on VLAN 6, the other is our main wireless on VLAN 1. The switch config tags VLAN 6 to each port with a Unifi hung off it. VLAN 1 is the default VLAN
nathan Posted July 10, 2014 Author Posted July 10, 2014 The "management VLAN" should be untagged. Then all the VLANs for the wireless SSIDs would be tagged. So am i correct in saying i could have the following on a port: untagged vlan10
Disease Posted July 10, 2014 Posted July 10, 2014 Talking about planning Vlans, does anyone know of a printable template which you can mark your vlans on or a free bit of software that allows you to plan them?
localzuk Posted July 10, 2014 Posted July 10, 2014 You can only have one vlan untagged. If you have your device untagged on another VLAN already, then any extra VLANs are tagged. Going by what you've said earlier, you appear to have an existing wireless SSID set up. What VLAN is that on? Are the access points themselves in their own VLAN? Or are they being given addresses in the "main wireless" VLAN?
nathan Posted July 10, 2014 Author Posted July 10, 2014 You can only have one vlan untagged. If you have your device untagged on another VLAN already, then any extra VLANs are tagged. Going by what you've said earlier, you appear to have an existing wireless SSID set up. What VLAN is that on? Are the access points themselves in their own VLAN? Or are they being given addresses in the "main wireless" VLAN? Nothing regarding vlans is setup at the moment. We just have two ssids setup; school school_guest These both go to the same place at the moment. Just running around the school to look at what switches we have; 2x Allied Telesis AT-GS900/24 1x HP Procurve 2610-24 (J9085A) 3x HP Procurve 1800-24G (J9028B) I know the 2610 supports tagging but i'm not 100% sure the Allied Telesis does. I'll investigate this.
localzuk Posted July 10, 2014 Posted July 10, 2014 Ok, if I were doing it, and the switches can handle tagging I would do it like this Switches/Wifi - VLAN 1 (default VLAN/Management VLAN) (untagged) Guest Wifi - VLAN 10 (tagged) Main Wifi - VLAN 11 (tagged)
nathan Posted July 10, 2014 Author Posted July 10, 2014 Ok, if I were doing it, and the switches can handle tagging I would do it like this Switches/Wifi - VLAN 1 (default VLAN/Management VLAN) (untagged) Guest Wifi - VLAN 10 (tagged) Main Wifi - VLAN 11 (tagged) Really sorry for all the questions, i've always been useless at VLANs. The main wifi ssid would want to talk to the main network devices etc. If it was tagged as vlan 11 would it be able to do that?
localzuk Posted July 10, 2014 Posted July 10, 2014 Ok, now you're talking about the inter-VLAN routing. Basically, you would want some form of routing device, be it a switch that has the capability (this is the best option), or a separate router. You'd then enable inter-vlan routing, so all VLANs would be able to communicate with each other. If you don't want the guest wifi to be able to access everything, you then add ACL rules to prevent it being able to communicate with things. By default, VLANs won't communicate with each other.
nathan Posted July 10, 2014 Author Posted July 10, 2014 Ok, now you're talking about the inter-VLAN routing. Basically, you would want some form of routing device, be it a switch that has the capability (this is the best option), or a separate router. You'd then enable inter-vlan routing, so all VLANs would be able to communicate with each other. If you don't want the guest wifi to be able to access everything, you then add ACL rules to prevent it being able to communicate with things. By default, VLANs won't communicate with each other. could i then in theory have the main wifi on vlan 1 (untagged)
Oaktech Posted July 10, 2014 Posted July 10, 2014 Really sorry for all the questions, i've always been useless at VLANs. The main wifi ssid would want to talk to the main network devices etc. If it was tagged as vlan 11 would it be able to do that? That is a question for either a Layer3 switch or a router. We have no inter vlan routing and exclusion ACLs for our setup as that is the whole point of the guest wifi. But if you have a half decent core switch or control of your router you should be able to do that. Our inter vlan routing is done by our core switch as that has the lowest distance overhead.
localzuk Posted July 10, 2014 Posted July 10, 2014 could i then in theory have the main wifi on vlan 1 (untagged) You could, yes.
Oaktech Posted July 10, 2014 Posted July 10, 2014 could i then in theory have the main wifi on vlan 1 (untagged) If thats where everything else lives then sure...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now