Procurve VLAN Perfomance question, tag ALL VLANS to ALL ports on ALL switches

[dan_lumbard]

Hi,

 

Ignoring issues with security of the IP subnets assigned to my different VLANs does tagging all ports on every switch have a bad effect on performance?

 

We have a L3 Procurve 2600 (J9264a) as our core switch which handles the inter VLAN routing, most of our other switches are L2 2510G

 

We have 30 or so wifi access points which assign VLANs dynamically dependent on who is logged on. At the moment I have tagged ALL VLANS on just the ports that the access points are connected to on the various switches around the buildings.

 

For an easier life after some patch panel re-wiring jobs I am about to perform, I was thinking about just tagging all VLANS to all ports on every switch. I know this will work but I wasn't sure if there is/how much of a hit we would take to the performance of the network?

 

I'd be most grateful if anyone has a definitive answer?

 

Cheers,

Dan.

[foofighterjim]

If all VLANs are tagged on all ports and switches wouldn't that defy the topological reasons for VLANing in the first place?

[localzuk]

If all VLANs are tagged on all ports and switches wouldn't that defy the topological reasons for VLANing in the first place?

 

Not necessarily, as each port would have its "default" vlan untagged, meaning the VLANs still exist to segregate things. I'm not 100% sure here. The main disadvantage is security - any device can connect to anything, and can therefore broadcast on any VLAN. You can also end up causing odd loopbacks if 2 are bridged etc...

[SYNACK]

802.11x and MAC address based VLAN assignment? May as well do it right if your switches support it.

[dan_lumbard]

Not necessarily, as each port would have its "default" vlan untagged, meaning the VLANs still exist to segregate things. I'm not 100% sure here. The main disadvantage is security - any device can connect to anything, and can therefore broadcast on any VLAN. You can also end up causing odd loopbacks if 2 are bridged etc...

 

Each port is untagged on the default vlan, so for a device to connect to a particular VLAN/subnet they would have to enable the VLAN settings on the NIC on a particular device. This would mean physically connecting to a network socket and this is a security risk I feel ok with, rogue devices in our school would almost exclusively be wireless devices such as mobiles/tablets etc.

 

The reasons for my different VLANs was to cut down the broadcast traffic (we were previously a flat network on a /21 subnet!!!!) it also allows a different route to the internet with particular ease based on AD groups. If there is no performance hit then tagging all ports on all switches gives me an easy life as I can make changes without having to worry about ports.

 

Thanks for the responses so far.

[localzuk]

You're just moving the config work there though. Rather than configuring the switch ports, you're configuring the device. Normal networking principals call for end devices not to want special configuration.

 

You'll eventually find items that don't support tagging, and then you'll end up with exceptions all over the place.

 

Also, you won't be able to tell at a glance which VLAN a port is using at any one time, so diagnostics will be more difficult.

[dan_lumbard]

Fair enough. But as we are setup right now it is only the WiFi access points that use the tagged VLANs and they do this dynamically according to rules on the controller. The untagged VLAN is what ALL our wired devices are running on so no extra config.

[SYNACK]

It will hit the speed as every frame from every port will need to be checked before it can be switched, whether this cripples your network or not is up to the switches and how many hosts. You could console in before and check the CPU usage, memory usage and queue depth before the change then again afterwards. Both at busy times of day to see the effect.

 

Again, this is not the right way to configure the switches and an automated vlan assignment based on mac address would be much better but it may still work if there is enough spare cpu horsepower and memory on all of your switches to accommodate the checking of every single frame at least once before it gets anywhere.

[Davit2005]

Whats to stop a student looping a cable between 2 wall ports and bringing all your vLANS down.

 

Unless of course you set up multilple vLAN spanning tree protocol on your edge switches.

 

And don't say they won't do it because I have seen it before.

[localzuk]

Indeed. We run 802.11x and MAC based auth on our network (MAC based for wired, 802.11x for wireless). The only ports that are tagged with "all" VLANs are the uplinks on each switch. The WAPs are tagged only on the wireless VLANs, and untagged on the management VLAN.

 

We rarely have to change any port config unless we completely move things around in the school, or if a specific piece of hardware doesn't work properly with the delay caused by the MAC based auth (printers are the main culprits for this).

[PotNoodleTech]

If all VLANs are tagged on all ports and switches wouldn't that defy the topological reasons for VLANing in the first place?

 

Yes - I fail to see the need for all of the broadcast traffic on each vlan to be forcibly broadcast to every port on the network. That does seem to kinda defy the "performance improvement" part of VLANs in the first place?

 

I only tag what needs to be tagged. I have whole switches that do not have VLANS set up on them as they are only ever going to be curriculum switches. Of course it can all be changed with a mouse click if needed.