Guest Guest Posted July 13, 2015 Posted July 13, 2015 150 PCs/laptops and 50 iPads currently running on a flat network at one site. We have servers/CCTV/access control/web. Would it be worth setting up VLANs?
simonm Posted July 14, 2015 Posted July 14, 2015 Hi, a useful test to do might be to run Wireshark and see how many broadcasts you have as a percentage of overall network capacity - because a vlan would help to contain the broadcasts fi they are high. Also, if you have a wireless network then there are advantages to having vlans as keeping unecessary broadcasts off that is a good idea because of the much slower speed ( typically ) of the wireless nework. From a security perspective it might also be good to have the access control and CCTV vlanned off the main network. rgds Simon
Guest Guest Posted July 14, 2015 Posted July 14, 2015 Hi, a useful test to do might be to run Wireshark and see how many broadcasts you have as a percentage of overall network capacity - because a vlan would help to contain the broadcasts fi they are high. Also, if you have a wireless network then there are advantages to having vlans as keeping unecessary broadcasts off that is a good idea because of the much slower speed ( typically ) of the wireless nework. From a security perspective it might also be good to have the access control and CCTV vlanned off the main network. rgds Simon I'll try and give that a go. Easy to do? Can I setup VLANs with what I have?
psydii Posted July 14, 2015 Posted July 14, 2015 The MS220 doesn't appear to have layer 3 capabilities which are required to route traffic between VLANs.
Guest Guest Posted July 15, 2015 Posted July 15, 2015 The MS220 doesn't appear to have layer 3 capabilities which are required to route traffic between VLANs. Would all the switches need to be layer 3?
psydii Posted July 15, 2015 Posted July 15, 2015 (edited) Just the one in the middle of the network. EDIT: Networks in SME and Secondary/Primary Education are typically a star with your edge switches all linked back into a single 'core' device. Classically called hub and spoke. Edited July 15, 2015 by psydii
localzuk Posted July 15, 2015 Posted July 15, 2015 Would all the switches need to be layer 3? You only need a Layer 3 device to route things - so usually this is your core switch. All the edge switches can be Layer 2. You'd want an MS320 or above for this role, using Meraki switchgear.
Guest Guest Posted July 15, 2015 Posted July 15, 2015 (edited) This is our current topology. Rectangles are switches and circles are APs. Edited July 15, 2015 by Guest
simonm Posted July 15, 2015 Posted July 15, 2015 Going from flat to VLANs and L3 routing is something you'd want to plan, and if you haven't done before take some advice, and certainly do some tests first. The other guys have commented that you need at least one switch ( with decent horsepower ) to route between vlans IF required. Also, you'd need to look at your DHCP and IP addressing, and work out how you're going to allocate the IP's to the new VLANs ( typically multiple DHCP scopes). Just out of interest have you run wireshark yet to see the kind of broadcast rate you typically run at ? - it may be that you don't see any huge performance benefit by going to multiple VLANs, but there are good reasons to consider it, like I said. Some people go OTT on VLANs, so there is a balance to be drawn.
simpsonj Posted July 15, 2015 Posted July 15, 2015 If you're interested, a similar thread on how to vLan was started a day or so ago, can be found here: http://www.edugeek.net/forums/how-do-you-do/156740-subnet-change-vlans.html#post1343661
Guest Guest Posted July 17, 2015 Posted July 17, 2015 I've got Wireshark and done a capture but how do I go about getting the relevant information?
localzuk Posted July 17, 2015 Posted July 17, 2015 Take a look under the Statistics menu. Protocol Hierarchy, Conversions and Endpoints will all assist here. ARP is broadcast traffic (ie. I want to speak to X tell me who X is), but there is other broadcast types too.
Guest Guest Posted July 17, 2015 Posted July 17, 2015 How long should I run a capture? I've got one with 16368 packets, 961 of which are Broadcast. 68080 bytes.
Blue_Cookeh Posted July 17, 2015 Posted July 17, 2015 To be honest I'm surprised you don't have any VLANs already if you have an IP based CCTV system. We're a smallish school and I've just implemented them so a) our iPads can have a transparent proxy, b) for guest wireless access and c) to separate IP phones from our computer network That's not a huge amount of broadcasts, are you running Wireshark on a machine with a mirrored port? You'll only be seeing your own machines traffic (and not ALL your broadcasts) if not.
Guest Guest Posted July 20, 2015 Posted July 20, 2015 To be honest I'm surprised you don't have any VLANs already if you have an IP based CCTV system. We're a smallish school and I've just implemented them so a) our iPads can have a transparent proxy, b) for guest wireless access and c) to separate IP phones from our computer network That's not a huge amount of broadcasts, are you running Wireshark on a machine with a mirrored port? You'll only be seeing your own machines traffic (and not ALL your broadcasts) if not. Not sure.
Blue_Cookeh Posted July 21, 2015 Posted July 21, 2015 To get a mirrored port you'll need to login to your switch and set that port to do it. I know on HP there's an option called 'mirror-port' but not sure about Cisco etc.
Muz Posted July 22, 2015 Posted July 22, 2015 You should really be using VLAN and ACLs to restrict traffic to your CCTV (which should be on it's own / management VLAN)
simonm Posted July 23, 2015 Posted July 23, 2015 Hi, sorry for delay in responding, been out and about. If you run a wireshark capture for 10 minutes during a typical first thing logon period ( might not be representative now if most people have packed up for the summer hols ) , and say in the middle of the day then that will just capture packets from your PC and the rest will be broadcasts, so no need to set up port mirroring. If you then just look at the total number of broadcasts AND multicasts ideally excluding any traffic from your PC then you should see an average kb/s or mb/s speed, thats what you're interested in.
Blue_Cookeh Posted July 23, 2015 Posted July 23, 2015 Arguably he should be using VLANs for QoS/some form of security if he's running IP based CCTV anyway, so broadcasts become a moot point.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now