VLANing a network

[rhys1984]

Hi guys,

 

 

Looking for a bit of advise.

 

 

We have a network - 10.56.80.0 - 10.56.87.255, Subnet 255.255.248.0, and we are looking to VLAN it so we can have a guest wireless service in addition to our existing staff wireless, but whilst keeping the same subnet mask as we only want to separate the wireless.

 

 

Our wireless solution supports VLANs - so in basic terms, what is the best way to do this?

 

 

Would we have to split up the network into smaller subnets first? Or could we use a new range (10.56.75.0) for example instead, and then set up routing back to the original network for the Staff side wireless (and how is this done)?

 

 

Cheers

Rhys.

[FN-GM]

If you won't be able to keep the same mask and add another vlan that has the same ip range as your existing.

 

You have 2 options.

 

1. Add a new range.

2. Break the current range into 2 and change the subnet mask.

 

Option 1 would be best if you don't want to mess with the mask, however if your connected the an LA that may cause some issues.

 

What make of Switch is your core?

Edited August 20, 2015 by FN-GM

[rhys1984]

Thanks for the reply - our core is Cisco. We do have an additional range (10.56.75.0) that we can use from the LA. How easy would it be setting up the required config etc for the ranges to talk to each other?

[rrrrr]

A 255.255.248.0 subnet is very large. if all your devices are on one vlan of that size it will probably cause a lot of network noise. (arp requests etc)

I would split your network up into separate vlans for a number of reasons.

Reduce network noice and possible network slowdown

Help protect against malicious attacks (can implement ACL's)

Protect againt packet storms, only 1 vlan will be affected.

 

Servers should be on their own vlan, a separate vlan for management, and a separate one for printers (as they create alot of network noise)

[ITGURU]

If the VLANS don't require any internet access through the LA then you can create whatever VLANS and IP ranges you want.

I've got the main 1 issued by the LA, but then have several other 172.1.x.x 172.2.x.x etc etc VLANs for other devices on the network but don't need internet access.

[FN-GM]

How easy would it be setting up the required config etc for the ranges to talk to each other?

 

Very easy, takes no time at all. You create a VLAN and give it an IP address and thats it!

 

The advice to split your existing range is good and I would do this. However it will take time to sort this and its nearly the end of summer.

[ITGURU]

For the ranges to talk , you need to choose a Layer 3 switch on your network, typically the core and add all the VLANs you want to communicate together with an Interface IP.

This switch then becomes your Default Gateway.

 

If you want to access all VLANs from your workstations, give it a static IP and set your default gateway to the L3 Switch and you'll have access to devices on all VLANs, whilst general DHCP users just use the main gateway for your IP range so won't see any of the VLANs.

[FN-GM]

For the ranges to talk , you need to choose a Layer 3 switch on your network, typically the core and add all the VLANs you want to communicate together with an Interface IP.

This switch then becomes your Default Gateway.

 

If you want to access all VLANs from your workstations, give it a static IP and set your default gateway to the L3 Switch and you'll have access to devices on all VLANs, whilst general DHCP users just use the main gateway for your IP range so won't see any of the VLANs.

 

The VLAN interface ip address becomes the default gateway not the switch IP address.

[ITGURU]

The VLAN interface ip address becomes the default gateway not the switch IP address.

 

Same thing - the VLAN interface IP is on the switch.

[psydii]

That looks to me like you are part of a larger network, probably managed by your LA or your RBC. If you want to chop it up/add additional VLANs your will either need their help (for routing internally) or 'double' NAT your network, moving your devices over to 172.16.x.x and treating the 10. network as 'external'.

[FN-GM]

Same thing - the VLAN interface IP is on the switch.

 

No, the switch IP and the VLAN interface IP are not the same thing. The switch IP address is used for management purposes and the VLAN ip is used for the routing. A switch can have many IP addresses for all different jobs. Plus the VLAN IP might be on many switches and routers depending on your setup, having HSRP setup is an example. If you make your default gateway on your VLANs point to the management IP address they will not be able to route between each other. You need to make sure the VLAN your clients are in are using that specific VLAN interface IP as the default gateway.

Edited August 20, 2015 by FN-GM

[ITGURU]

No, the switch IP and the VLAN interface IP are not the same thing. The switch IP address is used for management purposes and the VLAN ip is used for the routing. A switch can have many IP addresses for all different jobs. Plus the VLAN IP might be on many switches and routers depending on your setup, having HSRP setup is an example. If you make your default gateway on your VLANs point to the management IP address they will not be able to route between each other.

 

On my switches any VLAN Interface IP I create , it gives me the option to allow this IP as a Switch Management IP so that whatever VLAN I'm on I can access the switch interface whether its via a 10.x.x.x or 172.x.x.x address.

[FN-GM]

That looks to me like you are part of a larger network, probably managed by your LA or your RBC. If you want to chop it up/add additional VLANs your will either need their help (for routing internally) or 'double' NAT your network, moving your devices over to 172.16.x.x and treating the 10. network as 'external'.

 

If he subnets his existing range (10.56.80.0 255.255.248.0) there should be no changes required upstream as the routers etc will see the IPs coming from a range that is already configured in their system.

[FN-GM]

On my switches any VLAN Interface IP I create , it gives me the option to allow this IP as a Switch Management IP so that whatever VLAN I'm on I can access the switch interface whether its via a 10.x.x.x or 172.x.x.x address.

 

But that is still not a switch IP address. Its an interface IP, it just so happens that the switch concerned is "controlling" that ip at the time. I know a setup that has 3 layer 3 switches. All share the same VLAN IP addresses. You wouldn't use that VLAN interface IP for management as it could take you to any of the 3 switches. So each of the 3 switches has it own dedicated management IP so you can go to the specific switch.

 

If things where setup properly you would use 1 management IP from any VLAN.

 

For someone who is new to this, its import to make it clear that the default gateway points to vlan interface ip. If we use the term "switch ip" they could point it to the management IP and this will not work.

Edited August 20, 2015 by FN-GM

[rhys1984]

Thanks for all this brilliant advise - very helpful.

 

Could I clarify - a post above States that the LA may need to become involved to help route internally. Why is this - could we not just configure the default gateway (our L3 switch) ourselves to configure the routing between the new ranges/VLANs? If so, in a nutshell, how would I go about doing this - is it presumably Static Routing?

 

Thanks,

 

Rhys

[FN-GM]

Thanks for all this brilliant advise - very helpful.

 

Could I clarify - a post above States that the LA may need to become involved to help route internally. Why is this - could we not just configure the default gateway (our L3 switch) ourselves to configure the routing between the new ranges/VLANs? If so, in a nutshell, how would I go about doing this - is it presumably Static Routing?

 

Thanks,

 

Rhys

 

If you add any new IP ranges you will need to get them involved. You can just add a static route (not a default gateway on the switch but i get what you mean) but the upstream devices will have issues because the network traffic comes from "unknown" ip addressees.

 

You can chunk up your existing range into smaller subsets and that would not require the LA to be involved. However this is quite a job.

[rhys1984]

OK Thanks for that. We do have an alternative range already set-up by our LA which is for future use (10.56.75.0) - so could I just configure static routing on our L3 Switch between this range and our existing range?

 

Thanks

 

Rhys

[rhys1984]

Sorry guys - one last question: If we decide to go ahead with this, and create two VLANs (one on the 10.56.75.0 - VLAN1, with VLAN2 on the existing 10.56.80.0 interface), how would we then go about tagging the relevant wireless box port on the switch?

 

I.E: Our Wireless box will need to be configured as follows:

Staff wireless: VLAN2 - 10.56.80.0

Guest wireless: VLAN1 - 10.56.75.0

 

So what configuration would be required on the switch? Am I correct in thinking that a port on a switch can be configured with multiple VLANS?

 

Thanks,

 

Rhys

[rrrrr]

If your switch is layer 3, yes. Do you have a wireless controller? What vlan will the AP's management IP be on?

You will need to create 2 ssid's and assign then to the vlans

On the switch you wound untag on the management vlan and tag the ssid vlans

[rrrrr]

Also, its a bad idea to have a guest access with no isolation. If the guest wireless is not isolated from the rest of the network (acls etc) and only given bare minimum access (internet only) it could be used to attack your network with very little accountability

[rhys1984]

Ok - thanks for your help.

 

The main IP of the wireless box would be on the existing 255.255.248.0 network, with a two VLANs configured - one for Staff and one for Guest. Would this work OK?

 

Thanks,

 

Rhys

Edited August 21, 2015 by rhys1984

[rrrrr]

So the staff wireless will be the same ip range and vlan as the main network as well as the management interface of your ap's, and the guest wireless will be on a different vlan/ip range? If so on the switch port connected to the ap, untag the staff vlan (this should pass through to the default ssid) and then tag the guest vlan and link it to the guest ssid.

[rhys1984]

Yes that's correct - could you briefly explain what you mean by 'link it to the guest ssid' please?

[speckytecky]

Some superb reply son this thread, particularly by @FN-GM but I can't help but notice that even though thanks have been given in the texts the actual Thanks button hasn't been hit once. Perhaps it needs to be bigger?

[rrrrr]

On the config of your ap or ap controller, you should be able to assign a vlan to the ssid