Wireless VLAN's & DHCP Scopes

[MrFrostmaul]

Hi all,

I am currently looking at getting more control of our wifi network as currently it is just one big flat network with the wireless attached. We have the Aruba Instant wireless network with three SSID's (Staff, Students & Guest) and all of our switches are HP which are new (less than 2 years) old. I know we can assign a vlan id to each SSID in Aruba.

Currently looking at having three new scopes setup in our DHCP server which will serve these three wifi ssid's, so we have management of what ranges go to what SSID (for filtering purposes).

I have found this post online, which seems identical to what we are currently looking for: https://supportforums.cisco.com/discussion/12023411/how-do-i-make-windows-dhcp-work-vlans

This is the information I had from a company who installed the wireless in the first place, but could not do the vlans then and are now charging about £1000 for it to be completed.

 

• Configuration of Core Switch for VLAN Routing.
   
  
• Configuration of Edge Switches for New Wireless VLAN.
   
  
• Configuration of all Uplinks to carry the New Wireless VLAN
   
  
• Configuration of Cisco ASA for New Wireless VLAN.
   
  
• Assistance with DHCP Scope.
   
  
  

One of my concerns is that we want to keep the current DHCP scope as it is for the computers etc. On the network and the new scopes just for the wireless.

Another concern is that we have iPads in the school now and Air Server installed on almost all the computers with a projector, if we done the VLAN's, would the iPads still be able to communicate with Air Server on the computers which probably stay on VLAN 1?

Hope anyone can make sense of this and I can explain more if needed.

Many Thanks for your help

[DJamesS]

Evening,

In general, the solution you're looking for should be achievable, to a point.

Please can you post the models of HP switch that you're running, just to confirm that they are managed switches and are VLAN aware/configurable.

AirServer will be a sticking point. Unfortunately it doesn't easily cross subnets/VLANs. There are solutions to make it possible, but it adds a layer of complexity.

A possible solution would be to configure the switch ports that would be assigned to the Projector linked PCs, to be on the Staff Wireless VLAN/subnet (untagged). Ensure that the Staff subnet is routable with your default VLAN, assuming your servers live on the default VLAN and are accessed by the PCs. Staff/Class iPads (assuming they are not BYOD student iPads of course) could then send content to the Projector linked PCs. Student and Guest VLANs would be separate, and i assume certainly the guest VLAN/subnet would not be routable with the default or Staff VLAN/subnet.

 

All of this is pretty top-level, so apologies for the lack of specifics. Happy to help further if you think this approach would cover your AirServer requirement.

[Julian]

I would suggest not using 1 vlan for all network computers, but use several, so that a broadcast storm only takes down a small part of the network (if you have to pay some to set up vlans, get it done right!).

 

With a network of ~400 computers, and 35 switches, we ended up with 20 vlans. A computer on one vlan has no problem speaking to a computer/ iPad/ server on another vlan, as the data is routed from one vlan to another. We also use vlan's so that BYOD, are kept separate from our main network.

[emdrum]

The problem with all this is the Bonjour protocol. The iPads use broadcast to locate an Airplay server (such as Airserver) and the broadcast will not route across subnets. As an additional problem the iPads will only display the first 43 (from memory) devices it finds so if you want to connect to the 44th it will never show it. You need to segment your LANs and it sounds like you are already on that path.

 

First thing, AirServer Connect allows you to display a QR code on the laptop so that the iPad can use unicast to connect. This gets rid of the Bonjour problem as that can route. It's only part of the problem, though.

 

If you segment your network, which you will probably need to do anyway for performance reasons, you can use a Bonjour re-broadcast - I don't know Aruba but I think this is called Air Group? You need to configure that for the services you need on the VLANs you want. Basically the Airserver needs to be able to receive the Bonjour broadcasts from the network where the iPads are. We did this by zoning the network so that the Access Points in a physical location could broadcast Bonjour to the Wired VLAN in that physical location - then the staff only see devices that are local to them. You could theoretically take this down to an individual classroom VLAN, but that's a lot of VLANS and you can't guarantee that devices in a classroom will only connect to that classroom's AP. It could connect to the one next door, or upstairs, or outside.

 

In terms of the Procurves you need to get as much off VLAN 1 as you can or when the iPads start up you will have broadcast storms as Julian suggests. That can bring the whole thing to a halt.

 

We segmented the network into wired and wireless zones, each with a set of APs and Classrooms which overlap. Each zone can broadcast wireless to wired n that zone. We have 802.1x configured to drop users onto the right VLAN and give them access appropriate to their age-group through the firewall, with traffic profiles so that each has dedicated bandwidth and no-one can hog it all.

 

Hope that helps.

[Eudora931]

Subscribe

[MrFrostmaul]

Thanks guys for your input. We are looking at having the staff wifi only routable to the computers for AirServer and the other wifi ssid's to only be allowed to connect direct to the internet without any local devices.

 

Aruba does has a section on it called AirGroup and I can see on there all the different requests for AirPrint and AirPlay.

We currently have 77 iPads on our flat network and can already see the amount of broadcast storms it is doing so VLAN's are defiantly a need now.

 

I will double check the switches and get a list of the models on Monday as away tomorrow and Friday.

[graeme81]

Have a look at the Aruba Instant Validated Reference Guide. It will give you steps to get to where you want to get. There's an entire chapter on configuring your Instant APs to handle the Apple protocols.

 

Aruba Instant Validated Reference Design - Airheads Community

[talksr]

I would suggest not using 1 vlan for all network computers, but use several, so that a broadcast storm only takes down a small part of the network (if you have to pay some to set up vlans, get it done right!).

 

With a network of ~400 computers, and 35 switches, we ended up with 20 vlans. A computer on one vlan has no problem speaking to a computer/ iPad/ server on another vlan, as the data is routed from one vlan to another. We also use vlan's so that BYOD, are kept separate from our main network.

 

Do you have any recommendations on who you could pay to come in and set up vlans correctly?

[George_j]

We work with consultant who charges around £ 700.00 per day!

[talksr]

We work with consultant who charges around £ 700.00 per day!

 

Crikey, that is quite a lot, I guess he will know his stuff for that price!

[emdrum]

Hi Talksr,

 

You can get someone to set it up for you but unless you know what is being done and why it will become unmanageable for you. It really is worth the time and effort to get your head around this and learn how to do it. There are lots of tutorials online and people here who will help you, but if you can learn to manage it yourself then next time you have a problem you won't need a consultant.

 

£700 isn't over the odds, though, for someone to design and implement a network architecture that works - and yes, they should know what they are doing and transfer at least some of that knowledge to you.

[George_j]

Hi Talksr,

 

Emdrum is right, i totally agree with him.

 

If you are interested send me a PM and will pass your details to that guy.

[talksr]

Thanks both, I am clued up, did a CCNA a few years back, just don't have the time to focus on that and all of the other things I am doing.

Would be very happy to get someone in who works in this area all the time, set it up the way he and I feel best, and then I will take it on.

 

Like I say, it has been a few years, and I would rather implement something which works first time, then fart around working out why something I have done is not working as expected.

 

We have HP switches at the moment, which work reasonably similarly to the Cisco stuff I was trained on.

[emdrum]

Does the Aruba tunnel traffic back to the controller, or does it bridge it onto the local LAN? That would affect the architecture that you implement.

 

If it's tunneled then you should route everything back through the core as that's presumably where your Aruba controller is plugged in. You could then get the core switch to route the traffic onto the appropriate wired vlans so that they can use AirPlay. If you set up vlans for each physical area then the traffic for that area will be re-routed back to that area and you'll achieve a level of compartmentalisation.

 

If it's bridged onto a local vlan then there's no advantage to routing through the core and you could implement localized subnets between the wired and wireless devices so that the internal traffic never leaves that switch and only routes server and external access through the core. Each of your local subnets then becomes an independent broadcast domain.

 

Hope that helps.