VLANs... Where do you start

[bwestlake]

Want to implement VLANs on our network, understand basic concept but where do you start, does anyone have any suggestions on where you can learn basics and onwards,

 

also what things did you have to overcome when you implemented VLANs?

[Liam]

Plan plan and plan!!

[DalekSec]

You don't need to over VLAN networks, we run on 5 and we don't want any more!

 

Just gets complitcated and not worth the fuss!

[Liam]

Think about why you are doing it in the first place? What are your reasons?

Iv done things like cctv, cashless, data, telephony and byod.

Often people vlan and it just causes more issues becuse they rushed into it. Documentation is key. There are loads of threads on here about it

[jimmy_2k]

VLAN issues are the silent issue and can be a PITA to diagnose any issues. I inherited a school with 25 VLans once... *shakes head*

[synaesthesia]

As above, planning is key. If you have spare switches you can test with, do, and then remember that terminology often changes between switches even of the same manufacturer.

Understand trunking (a trunk port, not link aggregation although they certainly can and do meet), inter-vlan routing and the likes.

Understand what you'd need to do - assuming a change of IP address allocation, making the relevant changes to servers, switches etc.

Even then, keep it as simple as it needs be. We run 7 - site 1 clients, site 2 clients, telephony, CCTV, servers, isolated (for testing) and printers. Fault diagnosis isn't a problem as it is all documented.

[FN-GM]

If you have Cisco gear I would get Cisco Packet Tracer installed on a Windows PC and play around with that.

[zag]

Not a fan myself of VLAN'ing, it just overcomplicates things in my opinion.

[FN-GM]

Not a fan myself of VLAN'ing, it just overcomplicates things in my opinion.

 

With anything it will add complications but the befits massively outweigh the negative.

[pete]

Main sticking points:

• Have an up-to-date network map. Check it. Make sure you know where important things are connected, verify visually if you're not sure.
  
• Take note of where you've got a switch from manufacturer A talking to a switch from manufacturer B. Ensure they can agree on what's a VLAN.
  
• See if the firmware on your switches is up-to-date. Look at the release notes for newer releases - does it fix anything that may bite you?
  
• Check CPU utilisation on your cheaper switches - just because the manufacturer says your switch can do 30 wonderful things doesn't mean it can do them all at the same time without falling over. See also: spanning-tree.
  
• Plan what you're going to do before you do it. For example:
   
  CCTV server has a two-port intel NIC.
  NIC01 will be connected to SwitchA on port 03 in the CCTV VLAN.
  NIC02 will be connected to port 15 on the Desktops VLAN.
  So Switch A needs to have port 28 (uplink to rest of network) tagged in the Desktops VLAN and the CCTV VLAN. It also needs port 03 untagged in the CCTV VLAN and port 15 untagged in the Desktops VLAN.
  Switch B (PoE) needs ports 1-15 untagged in the CCTV VLAN with PoE turned on for cameras. It also needs port 28 (uplink) tagged in the CCTV VLAN so it can pass footage to the CCTV server.
  
• If you have a device with multiple interfaces in different VLANs, label them in the device config. In windows you'd just label the network connection "NIC01-CCTVLAN" and :NIC02-DesktopsVLAN"
  
• Ideally test it on spare hardware so you can compare what you think will happen is what really happens. Especially routing,
  
• Make sure your technical colleagues know what you plan to do and where the documentation is. Involve them so they can diagnose issues.
  
• And that your monitoring solution can access things on the new VLANs.
  

 

And document it properly so future you doesn't hate past you.

[clockend25]

I plan to VLAN here after holding on doggedly to a flat network for many years. I need to re-site my server room because at present our leased line isn't coming into the core switch; this probably won't happen until Easter, and then I'll move ahead with the VLANing. I'm currently working through the planning and testing it all out on some spare switches.

[FN-GM]

I plan to VLAN here after holding on doggedly to a flat network for many years. I need to re-site my server room because at present our leased line isn't coming into the core switch;

 

You could get around this with VLANs

[Disease]

If you have Cisco gear I would get Cisco Packet Tracer installed on a Windows PC and play around with that.

 

Even if you don't have cisco gear it's worth using I found it very useful and we use HP Procurve.

[jtotheb]

Hi, Mr Billion VLANs here. Planning and understanding are the keys to success. I wouldn't call a large network with 25-30 VLANs particularly complicated, but then that's my bread and butter. Like most things, it's all relative.

 

To the OP, don't do it "just because." Get stuck into some good material such as Cisco R+S and then Cisco Switch and Tshoot (or something agnostic). Design it, lab it, sim it until you've nailed it before you consider shunting that into production.

[clockend25]

You could get around this with VLANs

 

I've looked at that but it's not clean enough and the server room relocation is fairly straight forward and solves some other issues as well.

[Blue_Cookeh]

Plan plan plan as others have said!

 

We're a smaller school yet still run on a good few VLANs now. More and more devices want network connectivity so things like access control suddenly fall into my lap.

 

We have VLANs for:

Data

Voice

Third Parties

Management

Guest WiFi

CCTV

Mobile OS

Point to point links

Publicly routed addresses

 

The management of these isn't complicated IMO and has given me a lot of flexibility. Without VLANs there's no way in hell I'd run things like our public address space, guest WiFi, CCTV etc on our data network.

Edited September 30, 2016 by Blue_Cookeh

[Davit2005]

vLANS is one of the many security implementations you can have on a network as well as cutting down the size of the broadcast network.

 

It can be a bit daunting doing your first on a production network, something you could possibly do over a summer break without too much difficulty. You can use simple HP switches that support vlans like the 1810 at the edge and then a router to do the routing between them (router on a stick) or fully fledged managed switches, layer 3 core switch doing the routing and multiple links.

 

Packet tracer is a great tool as others have mentioned. You can even create DHCP servers with multiple scopes and create a IP phone setup with some IP phones in Cisco Packet tracer allthough you can't talk to eachother you can get them to call one another.

Edited September 30, 2016 by Davit2005

[LytchettNM]

Well I would start by saving a copy of your current switch config "just in case [emoji106]"

The main reason to VLAN in my opinion is to control subnet broadcast, we have 1 main VLAN per building or you could do per department, plus some site wide VLAN's for things like printing, cctv, WiFi, building controls etc etc plus we have 2 VLANs for core services "servers" and "device management".

You need to know which port of each edge switch faces the core network and for that matter you also need to know which port of your core faces each edge switch.

 

We aim for about 100 devices per VLAN where possible and find this works very well, this will also help determine how many VLANs you may want/need.

One device on your network will need to do the main routing, for us our core switch does this job, you can use 1 or 2 (failover) DHCP servers make sure you set up "IP helpers" on your core switching/ routing device as without DHCP relay will not work.

 

Hope this is helpful Darren

[FN-GM]

Well I would start by saving a copy of your current switch config "just in case [emoji106]"

The main reason to VLAN in my opinion is to control subnet broadcast, we have 1 main VLAN per building or you could do per department, plus some site wide VLAN's for things like printing, cctv, WiFi, building controls etc etc plus we have 2 VLANs for core services "servers" and "device management".

You need to know which port of each edge switch faces the core network and for that matter you also need to know which port of your core faces each edge switch.

 

We aim for about 100 devices per VLAN where possible and find this works very well, this will also help determine how many VLANs you may want/need.

One device on your network will need to do the main routing, for us our core switch does this job, you can use 1 or 2 (failover) DHCP servers make sure you set up "IP helpers" on your core switching/ routing device as without DHCP relay will not work.

 

Hope this is helpful Darren

 

This is sound advice.

 

One thing I would add it never use VLAN 1 as this can open up security problems.

[synaesthesia]

One good reason to VLAN is to cut the chatter between networks. The noisiest devices are often printers - sticking wireshark on our printer vlan is hilarious.

 

Imagine a crowded room full of people, there's music playing. It's difficult to get a conversation across as it is. Now, my wife is one of the loudest people on the planet. Each printer is equal to my wife. It's difficult to be heard over the noise one of My Wife makes, clone her and stick 40 in the same room - nothing will ever get done!

[LytchettNM]

Well I do use the default VLAN for switch management but no DHCP server so everything has to be static, this means I can un-box a new switch add an IP and plug in then config it from my desk [emoji41]

[m25man]

The primary purpose of VLANS is to maximise the effectiveness of your physical topology through the effective utilisation of all connections.

 

Historically and schools especially were never designed for connectivity, more ad-hoc badly designed and poorly implemented segments bolted on over the years created messy and poorly utilised chunks of wiring.

VLANS are then often introduced as a work around for the lack of infrastructure needed now to meet the demands of the modern classroom.

 

I still come across many schools that don't even have a L3 switch where it's needed most.

 

If you don't have the basic components in place and at least a reasonable physical topology installed then VLANS are NOT going to solve your problems!

 

If there is one lesson I've learnt over the very many years in this industry is you can't skimp on the fibre.

 

You can deploy and support hundreds of wireless nodes across a campus with dozens of VLANS but if you can't back haul them, they are as good as useless!

I've seen sites implement BYOD only to find the take up so high, the maximum number of concurrent connections brings the firewall CPU to a standstill and nobody can use the web!

 

If your infrastructure was up to the job it shouldn't really matter where your server room is in relation to the leased line or core switch.

 

Forget the VLANS initially, they are virtual and can easily be added later.

Think more carefully about what you want to achieve, calculate the number of client devices you need to support add 30%

Review the existing physical topology.

Ensure that the physical layers are capable of supporting the number and locations of your users first.

If you have 500 wireless users which APs will they be connecting to, how many users per AP?

What's the uplink capacity per AP?

How many APs per switch?

What's the PoE budget per switch?

Do I need 10GBe between switches?

Do I need 10GBe at the Access Point? (Xirrus arrays do 10GBe)

Where are the phones?

CCTV? IP or Other?

Digital Signage?

Multicast Services such as Triple Play or IP TV?

 

Once that's all been calculated THEN you can start to plan and colour in your VLANS

Regardless of the number of VLANS or subnets you think you need you still need the physical ports and multiple trunks/uplinks to support them!

 

Even though it's common practise to use LAN pass thru for IP Phones (VLANS are key to this type of deployment) I try not to cut back too much on the port counts as adding more later is too much of a pain and infinitely higher cost.

Whatever the number of fibre connections you think you need double them.

 

Physical first, VLANS second.