VLANS

[ellsandell]

Looking at changing our VLANS while we are installing Smoothwall, as they are fairly basic currently and will allow us to use our Ruckus for BYOD/Guest access properly.

 

 

We were thinking:

 

• Default - (for management/switches)
  
• ​Student BYOD - Smoothwall DHCP + Radius?
  
• Staff BYOD - Win Server DHCP (For managements sake as we will be a llowing access to SIMS/Shares)
  
• Curriculum - domain (Win Server DHCP 192.168.1.1 - 192.168.4.255)
  
• Admin - domain (Win Server DHCP 192.168.32.6 - 192.168.33.255)
  
• Guest - Smoothwall DHCP
  

 

Should we be looking into using more VLANS? (for Switches, Wireless APs, VOIP, Printers, Servers etc) We have an infrastructure range currently for our Managment PCS/ Servers (192.168.0.1 -.255), Printers are on a separate ip range (29.1 - 29.255).

 

 

Should we also be specifying the IPs in the VLANS aswell, currently it all goes through our TMG server (which is being replaced). Picking up a setup that was done by an external company. ​

 

Core Switch: HP 5406zl

Edge: HP2510G-48 & Allied Telesis AT9000/28

 

 

Current:

[/color][/size][/font][color=#000000][font=Calibri][/font][/color][size=1]exit
ip default-gateway 10.102.20.1 
vlan 1 
  name "DEFAULT_VLAN" 
  untagged A12-A13,A15-A16,A18-A22,A24-B1,B5-B10,B12-B14,B18-B19,B21-B24 
  ip address 10.102.20.20 255.255.252.0 
  tagged A1-A11,B2-B4,B11,B15-B17 
  no untagged A14,A17,A23,B20 
  ip igmp blocked B21-B24 
  exit 
vlan 2 
  name "Admin" 
  untagged A14,A17,A23,B20 
  tagged A1-A11,B2-B4,B16-B17 
  no ip address 
  exit 
vlan 33 
  name "BYOD-Students" 
  no ip address 
  exit 
timesync sntp
sntp unicast
sntp server priority 1 10.102.20.51 3[font=Verdana,Arial,Tahoma,Calibri,Geneva,sans-serif][color=#222222]

 

 

Any ideas would be appreciated.

 

 

Elliot

[Stuclark]

You don't *need* to be using VLANs for printers, VOIP, APs etc. unless you want to enable some form of QoS on them (e.g to allow a higher preference for VOIP than printing).

 

Again, you don't *need* to specify IPs on your VLANs, but if you intend to allow routing between them, or to allow them to use the same DHCP server, it may help to have IPs set so that the core switch can be the gateway for all of them, and so you can configure DHCP helper addresses.

 

We have just over 30 VLANs at the moment (mostly used to separate AppleTV traffic); some of which route through our core switches and some through our firewall - the ones going directly to our firewall are the ones we don't want to have any access to internal resources i.e. our student and guest wireless LANs.

[Techie2000]

Sorry to jump on the previous thread - @Stuclark - have you experienced better Apple TV connectivity when its on its own VLAN or is this just for good practice? Do you also have an exclusive SSID for Apple TVs?

[Stuclark]

Yes, generally speaking we've found Apple TVs to be more reliable when on seperate (departmental) VLANs. In our environment it means we can effectively guarantee no more than 50 devices on any one Apple TV VLAN at any one time; which helps cut down on the Bonjour traffic enourmously.

 

We use a seperate SSID for each VLAN, so have VLANs and SSIDs for Physics, Chemistry, English etc.

 

Apple TVs are more reliable when hard wired; but that presents issues with the teachers not knowing what network / VLAN they are on; as the Apple TV has no way of showing this.

[roadhouse1387]

Some good advice from Stuclark there Elliot, Its always more efficient to have your layer 3 switch doing the inter vlan routing than say a TMG (gawd! !) or some other software box because in general the switch will do it in hardware so its significantly faster, more efficient and doesn't slow down when it gets busy doing other things (as a TMG would do, or any other PC based product will do). Be aware though, as Stuclark says, you absolutely do not want to route your internal traffic/vlans on the same switch as your public or byod carrying vlans. By default, the switch will happily route between them providing no security whatever between them. Security is the watchword here. VLANS by themselves will not solve the problem.

 

You can... if you have the management time to spare, configure access control lists of the layer 3 interfaces between the vlans, but this will be very prone to error and is management intensive. Better if you can implement layer 3 path separation, which you cant do on an HP, so your only other option is to connect the layer 2 byod/public and so on vlans into your firewall as DMZ's and route from there.

 

This works quite well as long as you dont have mountains of vlans to secure, otherwise you will either run out of ports on the firewall or out of patience configuring gazillions of access rules for the individual vlans you will have to bring into the firewall on an 802.1q trunk.

 

Cheers

[Patman]

Hi Stuclark:

 

Sorry for the late question on this thread. If you are routing your students through the firewall, does this mean they cannot access the AppleTV? Does this mean they cannot share what is on their iPad on the AppleTV with the class? We are getting requests for AppleTV and we are trying to make sure we have the best configuration.

 

Thanks,

 

Patman