V-Lans and Stub Networks

[talksr]

Hi there,

 

We currently have two physical networks running off of our 200mbps LGFL broadband connection.

 

1.One is an admin network for the admin server and office computers and office photocopiers: 10.232.162.0/255.255.255.0

2.The other is a curriculum network for our curriculum servers and class computers/laptops/iPads/printers: 10.232.164.0/255.255.252.0

 

All of our servers (both admin and curriculum) are dual NIC and as such, are wired into both networks such that I can connect to either regardless of which physical network I am connected to.

 

We have a rack of 7 48 port layer 3 network switches running as a stack. I would very much like to v-lan our network, but I am looking for some suggestions on the best way to go about it. LGFL have suggested routing our network as a full /21 which would allow us to request the creation of a stub network such that we can create the vlans we require.

 

Does anyone have any suggestions on what I should do in terms of getting things set up?

I expect we would need the following vlans:

Admin Vlan

Curriculum Vlan

Managed Wireless Vlan

Future Cisco IP Telephony Vlan

 

 

Any suggestions would be very much appreciated. I really want to do this and do it right so it doesn't need much future thought or time investment.

Edited November 2, 2016 by talksr

[FN-GM]

That would be quite easy to setup without changing from a /21 to a /22. Even if you do use /21 using the scheme below will give you plenty of room for more vlans later. However if you kept to a /22 LGFL will not need to make any changes on their equipment.

 

Admin - 10.232.162.0 /24 (the same)

 

 

Curriculum - 10.232.164.0/23

Managed Wireless Vlan - 10.232.166.0/24

Cisco IP Telephony Vlan - 10.232.167.0/24

 

 

Have you considered merging the admin and curriculum networks? As your servers are in both networks I can't see any case not to.

 

Also who owns 10.232.163.0 /24 ? There seems to be a gap in addressing between the 2 networks.

Edited November 2, 2016 by FN-GM

[talksr]

That would be quite easy to setup without changing from a /21 to a /22. Even if you do use /21 using the scheme below will give you plenty of room for more vlans later. However if you kept to a /22 LGFL will not need to make any changes on their equipment.

 

Admin - 10.232.162.0 /24 (the same)

 

 

Curriculum - 10.232.164.0/23

Managed Wireless Vlan - 10.232.166.0/24

Cisco IP Telephony Vlan - 10.232.167.0/24

 

 

Have you considered merging the admin and curriculum networks? As your servers are in both networks I can't see any case not to.

 

Also who owns 10.232.163.0 /24 ? There seems to be a gap in addressing between the 2 networks.

 

Hi, thanks for your reply.

Your suggestion sounds like a good idea to me. My only question is, with the scheme you suggest is how would the vlans cross communicate? As an example, at the moment the devices on the curriculum network include all wireless devices. If we put managed wireless son a separate vlan, I would still need all of this traffic to talk to the curriculum network for DHCP and file shares etc. How would I achieve this, through an inter-vlan route?

 

In terms of the gap between the two networks, I have no idea. You are correct, and I have left it exactly as it is since I took on the network. From what I can see, it has been like it for a very long time, so not sure if it was something LGFL implemented, or if maybe there was a separate administration network for the administrator?

 

Had looked at merging both admin and curriculum, but we have always tended to keep them appart as a few years back, we had lots of network loops on curriculum which would bring down both curriculum and admin, grinding the school to a halt. Not long after taking on the job, I added the l3 switches and enabled STP and loop-protect, which did away with this, but have always kept things separate as it seems a more simple solution without too many complications.

[FN-GM]

Your suggestion sounds like a good idea to me. My only question is, with the scheme you suggest is how would the vlans cross communicate? As an example, at the moment the devices on the curriculum network include all wireless devices. If we put managed wireless son a separate vlan, I would still need all of this traffic to talk to the curriculum network for DHCP and file shares etc. How would I achieve this, through an inter-vlan route?

 

Are those 7 switches the only ones you have? Are they Layer 3? What make and model are they? Indeed it would be inter-vlan routing.

 

Whilst you are doing this I would seriously consider merging your 2 networks into 1. If you do I would do this:

 

Client VLAN 1 - 10.232.162.0 /24

Client VLAN 2 - 10.232.163.0 /24 - If you can use it!

Client VLAN 3 - 10.232.164.0/24

Client VLAN 4 - 10.232.165.0/24

Managed Wireless Vlan - 10.232.166.0/24

Cisco IP Telephony Vlan - 10.232.167.0/24

 

Don't separate staff student machines there is no benefit to that and creates extra work. Just spread your client ports over those vlans.

Edited November 2, 2016 by FN-GM

[talksr]

Are those 7 switches the only ones you have? Are they Layer 3? What make and model are they? Indeed it would be inter-vlan routing.

 

Whilst you are doing this I would seriously consider merging your 2 networks into 1. If you do I would do this:

 

Client VLAN 1 - 10.232.162.0 /24

Client VLAN 2 - 10.232.163.0 /24 - If you can use it!

Client VLAN 3 - 10.232.164.0/24

Client VLAN 4 - 10.232.165.0/24

Managed Wireless Vlan - 10.232.166.0/24

Cisco IP Telephony Vlan - 10.232.167.0/24

 

Don't separate staff student machines there is no benefit to that and creates extra work. Just spread your client ports over those vlans.

 

Ok, makes sense, but admin and curriculum have different servers with different domains. Can more than one domain operate with your suggested setup?

The majority of the switches are HP Procurve 2510G-48 The model no is J9280A.

We then have a couple of 8 port HP ones connected to the servers and APC network UPS: HP 2530-8G model no: J9777A.

[FN-GM]

Can more than one domain operate with your suggested setup?

 

They can. But you could keep 1 client VLAN for admin and route between them. I would then work towards getting rid of the admin domain.

[MatthewL]

In this day and age there is no need for separate admin/curriculum networks, it causes more issues than its worth.

 

The only thing I would add is to have your servers on a separate VLAN but that is personal preference.

[talksr]

They can. But you could keep 1 client VLAN for admin and route between them. I would then work towards getting rid of the admin domain.

 

Ok, thanks for the clarification

 

In this day and age there is no need for separate admin/curriculum networks, it causes more issues than its worth.

 

The only thing I would add is to have your servers on a separate VLAN but that is personal preference.

 

Ok, so let me try and get my head around this.... so you would use one of the networks, say 10.232.164.0 and presumably segment it up for the V-lans?

Would you segment it based on the subnet?

[FN-GM]

Ok, so let me try and get my head around this.... so you would use one of the networks, say 10.232.164.0 and presumably segment it up for the V-lans?

Would you segment it based on the subnet?

 

Sorry I am not sure what you mean here.