Flat network to VLANs?

[Guest Guest]

150 PCs/laptops and 50 iPads currently running on a flat network at one site. We have servers/CCTV/access control/web. Would it be worth setting up VLANs?

[IanT]

I would say yes.

 

What switches do you have>?

[Guest Guest]

Cisco Meraki MS220s.

[simonm]

Hi, a useful test to do might be to run Wireshark and see how many broadcasts you have as a percentage of overall network capacity - because a vlan would help to contain the broadcasts fi they are high. Also, if you have a wireless network then there are advantages to having vlans as keeping unecessary broadcasts off that is a good idea because of the much slower speed ( typically ) of the wireless nework. From a security perspective it might also be good to have the access control and CCTV vlanned off the main network.

rgds Simon

[Guest Guest]

Hi, a useful test to do might be to run Wireshark and see how many broadcasts you have as a percentage of overall network capacity - because a vlan would help to contain the broadcasts fi they are high. Also, if you have a wireless network then there are advantages to having vlans as keeping unecessary broadcasts off that is a good idea because of the much slower speed ( typically ) of the wireless nework. From a security perspective it might also be good to have the access control and CCTV vlanned off the main network.

rgds Simon

 

I'll try and give that a go. Easy to do? Can I setup VLANs with what I have?

[psydii]

The MS220 doesn't appear to have layer 3 capabilities which are required to route traffic between VLANs.

[Guest Guest]

The MS220 doesn't appear to have layer 3 capabilities which are required to route traffic between VLANs.

 

Would all the switches need to be layer 3?

[psydii]

Just the one in the middle of the network.

 

EDIT: Networks in SME and Secondary/Primary Education are typically a star with your edge switches all linked back into a single 'core' device. Classically called hub and spoke.

Edited July 15, 2015 by psydii

[localzuk]

Would all the switches need to be layer 3?

 

You only need a Layer 3 device to route things - so usually this is your core switch. All the edge switches can be Layer 2. You'd want an MS320 or above for this role, using Meraki switchgear.

[Guest Guest]

This is our current topology. Rectangles are switches and circles are APs.

 

Edited July 15, 2015 by Guest

[simonm]

Going from flat to VLANs and L3 routing is something you'd want to plan, and if you haven't done before take some advice, and certainly do some tests first. The other guys have commented that you need at least one switch ( with decent horsepower ) to route between vlans IF required. Also, you'd need to look at your DHCP and IP addressing, and work out how you're going to allocate the IP's to the new VLANs ( typically multiple DHCP scopes).

 

Just out of interest have you run wireshark yet to see the kind of broadcast rate you typically run at ? - it may be that you don't see any huge performance benefit by going to multiple VLANs, but there are good reasons to consider it, like I said. Some people go OTT on VLANs, so there is a balance to be drawn.

[simpsonj]

If you're interested, a similar thread on how to vLan was started a day or so ago, can be found here:

 

http://www.edugeek.net/forums/how-do-you-do/156740-subnet-change-vlans.html#post1343661

[Guest Guest]

I've got Wireshark and done a capture but how do I go about getting the relevant information?

[localzuk]

Take a look under the Statistics menu. Protocol Hierarchy, Conversions and Endpoints will all assist here. ARP is broadcast traffic (ie. I want to speak to X tell me who X is), but there is other broadcast types too.

[Guest Guest]

How long should I run a capture? I've got one with 16368 packets, 961 of which are Broadcast. 68080 bytes.

[Blue_Cookeh]

To be honest I'm surprised you don't have any VLANs already if you have an IP based CCTV system. We're a smallish school and I've just implemented them so a) our iPads can have a transparent proxy, b) for guest wireless access and c) to separate IP phones from our computer network

 

That's not a huge amount of broadcasts, are you running Wireshark on a machine with a mirrored port? You'll only be seeing your own machines traffic (and not ALL your broadcasts) if not.

[Guest Guest]

To be honest I'm surprised you don't have any VLANs already if you have an IP based CCTV system. We're a smallish school and I've just implemented them so a) our iPads can have a transparent proxy, b) for guest wireless access and c) to separate IP phones from our computer network

 

That's not a huge amount of broadcasts, are you running Wireshark on a machine with a mirrored port? You'll only be seeing your own machines traffic (and not ALL your broadcasts) if not.

 

Not sure.

[Blue_Cookeh]

To get a mirrored port you'll need to login to your switch and set that port to do it.

 

I know on HP there's an option called 'mirror-port' but not sure about Cisco etc.

[Muz]

You should really be using VLAN and ACLs to restrict traffic to your CCTV (which should be on it's own / management VLAN)

[simonm]

Hi, sorry for delay in responding, been out and about. If you run a wireshark capture for 10 minutes during a typical first thing logon period ( might not be representative now if most people have packed up for the summer hols ) , and say in the middle of the day then that will just capture packets from your PC and the rest will be broadcasts, so no need to set up port mirroring. If you then just look at the total number of broadcasts AND multicasts ideally excluding any traffic from your PC then you should see an average kb/s or mb/s speed, thats what you're interested in.

[Blue_Cookeh]

Arguably he should be using VLANs for QoS/some form of security if he's running IP based CCTV anyway, so broadcasts become a moot point.