VLAN for wireless network across subnets

[Sheridan]

I'm just planning what I'm about to do with our wireless makes sense - I know a lot of you will have already done something similar so I'm just doing a reality check!

 

We basically have network cabinets around the school, connected by fibre back to a main cabinet with a core switch. All the fibres terminate in the core switch and each fibre port is a subnet - routed at the core switch. No vlans are currently set up but the various (192) subnets can route across each other perfectly through the core switch. Its probably not the best solution but it works fine and releases a lot of ip addresses, as each subnet uses a DHCP range.

 

In each subnet/cabinet there are wireless APs - so the various APs have different IP addresses across the school - routing makes sure that they all report back to the controller and clients can connect. As we are planning to expand and upgrade our wireless it makes sense to move the APs onto a wireless VLAN - making sure the clients stay on a seperate IP address range just for wireless clients (and possibly guest clients on another vlan in the future)

 

My understanding is that I need to tag the ports (i.e vlan 50) that the APs are directly connected to in the edge switches, and tag the uplink ports in the edge switches for VLAN 50, At the core switches the uplink ports will also need to be tagged for this VLAN as well?

 

At the core switch I will create a VLAN that has a seperate IP address (another 192 range) - so any clients attaching to the APs are on that VLAN and will get a seperate IP address from the DHCP server, meaning their address won't change as they roam around the school.

 

Does that sound correct? Its not often I have to work with VLANs so I'd appreciate any comments!

[jamesfed]

The guide I made a little while back on setting up WiFi may well help - Series: 4 SSIDs 1 Secondary Academy « my world of IT

 

You are on the right lines in that you will need a new VLAN for your wireless traffic however I don't really understand what you mean about each fibre port being a subnet? Do you have a network diagram with the subnets you are using listed out on?

[Sheridan]

At the core switch each of the edge switches is connected through a 10G fibre port. Those ports have their own IP address which is a seperate range (i.e 192.168.10.0,192.168.20.0 etc) so that we effectively have 9 subnets. The 10G ports are routed by the core switch - so effectively the seperate blocks of the school have their own IP range. Its almost like vlans with out any tagging etc - but I want to 'overlay' a vlan across the various subnets for the wireless.

[FN-GM]

however I don't really understand what you mean about each fibre port being a subnet? Do you have a network diagram with the subnets you are using listed out on?

 

Those fibre ports are L3 ports, not the most common L2. An IP address has been assigned on the port itself. In the Cisco world you put the command No Switchport to do this. Its more commonly seen in large networks and WAN links. We use them here to connect the schools in the MAT. Each "core" has a L3 ports configured (on both sites, not just one like this configuration) and the traffic is routed between them.

 

 

@Sheridan you would need to remove these IP addresses from the ports and use VLANS instead. Once you have done this change these fibre ports into L2 802.1q ports, if its HP im not 100% sure on the procedure.

Edited April 26, 2016 by FN-GM

[Sheridan]

This is all Netgear stuff- M6100 series. Sounds like @FN-GM has the same sort of setup (on a larger scale)

 

So I guess I'd have create VLANs to replace our existing subnet ranges, and then remove the IP addresses from the ports. I'll need to get the VLANs to effectively replicate the current setup as we have fixed IP address devices and DHCP ranges all setup.

[Sheridan]

I guess is going to be more tricky than I thought! My L3 ports having routing enabled, which I can disable and effectively set them to switch ports. Then the core switch would have no routing information so I would have to build the VLANs to correspond with our existing DHCP ranges althought I'm not sure how to tag the ports at the edge switch end to do this.

 

Looks like this will be a summer job after all, its not something I can practice on a live setup!

[FN-GM]

I guess is going to be more tricky than I thought! My L3 ports having routing enabled, which I can disable and effectively set them to switch ports. Then the core switch would have no routing information so I would have to build the VLANs to correspond with our existing DHCP ranges althought I'm not sure how to tag the ports at the edge switch end to do this.

 

Looks like this will be a summer job after all, its not something I can practice on a live setup!

 

Yep that would be what I would expect.

 

I think you could actually do it thought with little downtime if it is well planned.

 

Who set this network up? It does seem an unusual configuration for what you have.

[Davit2005]

I guess is going to be more tricky than I thought! My L3 ports having routing enabled, which I can disable and effectively set them to switch ports. Then the core switch would have no routing information so I would have to build the VLANs to correspond with our existing DHCP ranges althought I'm not sure how to tag the ports at the edge switch end to do this.

 

Looks like this will be a summer job after all, its not something I can practice on a live setup!

 

If you had a copy of Packet Tracer you could prob test the theory and basic setup at least.

 

Once you get used to vLANs they are far less daunting.

[Sheridan]

Yeah the part that I'm struggling with is converting the working static routes are the core switch to vlans that will correspond to a dhcp range - its not something I can easily test!

[FN-GM]

Yeah the part that I'm struggling with is converting the working static routes are the core switch to vlans that will correspond to a dhcp range - its not something I can easily test!

 

You won't need to create any static routes. Once you create a VLAN interface it will populate the routing table automatically.

[Sheridan]

You won't need to create any static routes. Once you create a VLAN interface it will populate the routing table automatically.

 

Thats what I thought, but when I created a new vlan on the core server (for an unused ip range) it creates the route, but nothing plugged into that port can see anything - I would have though the vlan's gateway address should be pingable from a client on that newly created vlan!

[FN-GM]

Thats what I thought, but when I created a new vlan on the core server (for an unused ip range) it creates the route, but nothing plugged into that port can see anything - I would have though the vlan's gateway address should be pingable from a client on that newly created vlan!

 

It should be ping able as this isn't working at Layer 2, we can ignore the routing table for now. Not sure on Neatgear but on many devices a new VLAN interface is shutdown by default?

[Sheridan]

On the netgear the VLAN is open and has Routing enabled once you create it. I think I'm missing something here as I've created a single test vlan on a spare port on the core switch and stuck a laptop in it. The new vlans gateway address is visible from other devices on the core switch, but not the laptop attached. I assume I've got the tagging wrong or missing here.

[Sheridan]

Actually, am I overcomplicating this? Removing all the static IP addresses (and thereby the routes) from the fibre ports will mean I can then add a VLAN for each subnet and all I would need to do is Tag the fibre port for that VLAN to match the ranges I already have - as all of the kit 'downstream' from the core switch would end up on that single port/VLAN?

 

I.e At the core switch fibre port 1 has the fixed address of 192.168.10.0 - with routes in place for that. If I delete that and create a VLAN 10/192.168.10.0 and mark Port 1 as Untagged for VLAN 10 it means the downstream switches and PCs etc will all arrive on that VLAN - I would have to repeat this for the other ports as well.

 

It would then be a case of adding VLANS for the wireless but tagging the actual ports the APs are connected to. Or maybe I've oversimplifing it!

[LytchettNM]

You need to understand the VLAN tagged / untagged bit before you do anything else, in very simple terms a switch port can be in 1 of 3 states,

Untagged - computer or laptop to directly connect to.

Tagged - this in normally used between two switches carrying multiple VLAN's

Or hybrid - this is a combination of both, say default network 1 plus multiple VLAN's.

 

So assuming you have a spare switch to play with create your test VLAN on your core switch and add you spare port to this VLAN tagged, then connect your spare switch to this port.

Then setup spare switch with the same VLAN adding the port that connects to the core switch tagged and another port to the same VLAN untagged, you should now be able to connect you laptop to the untagged port and fingers crossed it should work.

[Sheridan]

You need to understand the VLAN tagged / untagged bit before you do anything else, in very simple terms a switch port can be in 1 of 3 states,

Untagged - computer or laptop to directly connect to.

Tagged - this in normally used between two switches carrying multiple VLAN's

Or hybrid - this is a combination of both, say default network 1 plus multiple VLAN's.

 

So assuming you have a spare switch to play with create your test VLAN on your core switch and add you spare port to this VLAN tagged, then connect your spare switch to this port.

Then setup spare switch with the same VLAN adding the port that connects to the core switch tagged and another port to the same VLAN untagged, you should now be able to connect you laptop to the untagged port and fingers crossed it should work.

 

Yes I have the default VLAN 1 so I'd need that untagged on the uplink ports. I'm thinking of splitting the static routes into VLANs, so each edge cabinet will be one VLAN but will include a couple of APs on another VLAN, which I guess means tagging the APs ports as well as the uplink ports.

[LytchettNM]

OK it sounds like your got it.

What we do is used default VLAN 1 as our equipment management and then have a VLAN for each building in our case, with a few site wide VLAN's used for wireless, printing, cctv and BMS etc.

So yes on your edge switch you add a VLAN with the ports facing the computers untagged and the port facing back to your core tagged, I would imagine you will have a VLAN for say wifi tagged on the uplink port of your edge switch and tagged on the port facing your WAP.

What we do in our network is a subnet per VLAN and that VLAN services up to 4 x 48 port switches so that there is no more than 200 ip's per VLAN.