karldenton Posted January 27, 2016 Posted January 27, 2016 Hi Moving to a few server setup hopefully in the summer and will be setting up most things from scratch. We currently have a DHCP superscope internally with address 10.10.6.x , 7.x, 8.x, 9.x and 10.x What is the best way going forward to create a future proof scope. We have external nurseries that will be on the same LAN so they need a range ideally. We have become a MAT so could take on another school so eventually they will be on the same lan. Can you make it so certain OU's in AD pickup a certain range of addresses ? Thanks
pantscat Posted January 27, 2016 Posted January 27, 2016 How's your network infrastructure? If it's a decent network, then you'll be able to do dynamic VLAN assignment (and therefore subnet assignment) by using 802.1x port authentication. Basically the switch asks the device that is plugged into it to authenticate and you can configure it to do so based on Active Directory groups. Then depending upon which group the PC is a member of will dictate which VLAN it gets assigned to. Also - if it's a rogue device (e.g. one that's not a member of your network) then it'll get chucked into an isolation VLAN where it can't talk to anything... so quite nice from a security point-of-view, too.
Davit2005 Posted January 27, 2016 Posted January 27, 2016 Maybe size the scopes starting with the biggest plus at least 30% extra addresses. You prob don't need scopes that big though, out biggest scopes are /22 and that gives you 1022 addresses. We do have a smallest scope of /25 but our vLans are a complete mess to be honest with Class A, Class B and Class C ranges, We really could do everything in a Class B. You maybe able to do thing's via AD but might be just better to allocate via building or application i.e. VOIP, Printers etc.
karldenton Posted January 27, 2016 Author Posted January 27, 2016 I was thinking 172.160.1 - 172.16.255.254 on a 255.255.0.0 subnet giving 65534 addresses :) We don't have any VLans and the switches are not really up to it. I'd like to assign it so for EG 0.x = servers, 1.x = Site 1 computer, 2.x = Site 2 printers etc Would this be OK? Happy for any suggestion
pantscat Posted January 27, 2016 Posted January 27, 2016 Will the sites be directly connected to you? Or is there a router in the way?
karldenton Posted January 27, 2016 Author Posted January 27, 2016 At present they are directaccess so its that that gives out an IPV6 address. There will be a Sophos UTM on the main site with the other sites connected via a Sophos RED15, which if I've read it correctly, gives the clients at that end IP addresses off the main LAN - its just like a long network cable. (I think)
pantscat Posted January 27, 2016 Posted January 27, 2016 Yep - I think that's pretty much correct - the RED15 box creates a VPN tunnel back to your Sophos UTM so in effect it'll appear to the end users at the remote sites that they're on your LAN. In that case given your network, I'd go with a single subnet.
twin--turbo Posted January 27, 2016 Posted January 27, 2016 We don't have any VLans and the switches are not really up to it. What are they?? You need to be moving towards VLANS to control the traffic. Don't be afraid of them, they are not VooDoo. TT
karldenton Posted January 28, 2016 Author Posted January 28, 2016 Yep - I think that's pretty much correct - the RED15 box creates a VPN tunnel back to your Sophos UTM so in effect it'll appear to the end users at the remote sites that they're on your LAN. In that case given your network, I'd go with a single subnet. Thanks, so is there a way to assign certain IP range to a certain OU / Site
Davit2005 Posted January 28, 2016 Posted January 28, 2016 Thanks, so is there a way to assign certain IP range to a certain OU / Site The easiest way to do this is with vLANS as @twin--turbo mentioned they are not voodoo :-) . There are plenty of threads on here regarding vLANS and this would be possibly the easiest to manage setup once it is in place. Can you let us know what switches you have in place. Alternatively assign reservations via DHCP or static IP's and carefully document any static IP's given.
pantscat Posted January 28, 2016 Posted January 28, 2016 Thanks, so is there a way to assign certain IP range to a certain OU / Site Yep, but VLANs are the key. As others have said, they're really not complicated once you get your head around it, and they'll definitely make management of the network easier.
karldenton Posted January 28, 2016 Author Posted January 28, 2016 Thanks, the switches are, Netgear FS750T2 and GS748T
pantscat Posted January 28, 2016 Posted January 28, 2016 You can configure VLANs on both of these models.
twin--turbo Posted January 28, 2016 Posted January 28, 2016 Ahh, FS/GS are totally unmanaged from memory... unless they have basic WEB management. I think there should be a review of the network infrastructure before adding to it. Last time i bought an unmanageable switch was probably 12-13 years ago. TT
Boredguy Posted January 28, 2016 Posted January 28, 2016 Both the models support vLan configuration as they are classed as Smart Switches, but they are only layer 2 (the GS might be 2+ depending on the version) so inter vLan routing won't be easy/possible. For pure separation or edge switches they would be fine.
pantscat Posted January 28, 2016 Posted January 28, 2016 I *think* you can configure static routes on the Sophos UTM...
twin--turbo Posted January 28, 2016 Posted January 28, 2016 Yeah just looked. They can do 802.1q vlans via Smart Web Management. but have no Routing ability, this could be left to the utm/router though. Or a new L3 ( lite) capable switch. TT
twin--turbo Posted January 28, 2016 Posted January 28, 2016 I *think* you can configure static routes on the Sophos UTM... On My home UTM9 i can do all normal routing and vlanning functions.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now