Are VLANs worth the extra work?

[altecsole]

We've a flat network with around 600 clients and 20 servers. It's one of those networks that has grown over the years; initially on a very small budget, then some money to expand, and now back to a small budget again.

 

So, with little money to play with I'm re-visiting those jobs that have been on the 'back burner'. One of those jobs it to look at VLANs.

 

I understand that it's good from a security point of view and also to reduce broadcast traffic. However, being a school, everybody wants access to everyting, from everywhere. So, is it worth doing?

[DavetheITguy]

I work in an Academy and I have VLANd everything off with separate IP Schemes. I think it is worth it. We have printers, faculty PCs, student PCs, BYOD wifi, Staff Wifi, Student Wifi, CCTV etc. I think it organises the network really well.

[pantscat]

Yep, it's worth it.

 

Allows you to segment either geographically or by access requirement - which can help if you need to do anything very clever in the future.

 

The reduction in broadcast traffic should make a difference to network performance, too.

 

For schools, unless you've got a massive campus, I usually recommend doing it by device type and access requirement, e.g. a separate VLAN for:

 

- Servers

- SAN

- Network management

- ILO (or whatever you might use!)

- Student workstations

- Student laptops

- Student tablets

- Staff workstations (you could split this further - admin and teaching staff, perhaps?)

- Staff laptops

- Staff tablets

- CCTV

- VoIP

- Printers

- Digital signage

 

etc...

[DavePa]

If there is no or minimal cost then I'd say VLANs a worth looking at for exactly the reasons you give. We separate: Wired devices (although printers/servers/devices all share the same VLAN)), BYOD devices, Infrastructure (Switches, APs) and Telephnes. Problems one one VLAN don't affect the others.

[altecsole]

Many thanks for the replies.

 

Okay, so it seems that it is worth it and I do need to investigate further. Unfortunately, we don't have a full Layer 3 switch so it looks like I'll have to get one of those - any recommendations for switches that are particularly good at setting up VLANs?

[pantscat]

What make is the rest of your network kit? I like to keep to to the same manufacturer...

 

You can't really go wrong with HP Procurve, Cisco or Juniper kit, though.

[altecsole]

What make is the rest of your network kit? I like to keep to to the same manufacturer...

 

You can't really go wrong with HP Procurve, Cisco or Juniper kit, though.

 

A real mixture of Dell, D-Link and Netgear - not ideal I know but you can only spend what your budget allows!

[pantscat]

A real mixture of Dell, D-Link and Netgear - not ideal I know but you can only spend what your budget allows!

 

Well, in that case, I'd go for a nice L3 HP Provcurve switch at your core - most of them come with lifetime warranties and they're usually a lot cheaper than the equivalent bit of Cisco kit.

 

Then plan a rolling upgrade of the rest of the kit so you've got a consistent setup.

Edited November 29, 2016 by pantscat

[Blue_Cookeh]

Tbh I'd focus on getting a consistent infrastructure first, the different quirks when it comes to terminology and setups regarding VLANs across Dell/HP/Cisco/Netgear/D-Link/Juniper/ is going to give you some huge headaches.

 

But yes, I really would look at VLANs with that amount of clients, I'm honestly surprised you're not seeing terrible network performance already, especially with WiFi and the amount of broadcasts there must be!

 

We have around 150 clients on our network, laptops/desktops/phones/servers/CCTV/doors and I VLAN'd everything up about two years ago.

[altecsole]

Tbh I'd focus on getting a consistent infrastructure first, the different quirks when it comes to terminology and setups regarding VLANs across Dell/HP/Cisco/Netgear/D-Link/Juniper/ is going to give you some huge headaches.

 

But yes, I really would look at VLANs with that amount of clients, I'm honestly surprised you're not seeing terrible network performance already, especially with WiFi and the amount of broadcasts there must be!

 

We have around 150 clients on our network, laptops/desktops/phones/servers/CCTV/doors and I VLAN'd everything up about two years ago.

 

We have 50 switches on our network! It's a large site with lots of different buildings and a network that was 'lashed' together. To be honest, it seems to work pretty well but you can see it's a bit of a daunting task to implement VLANs!

[Oaktech]

I have 2 quite small networks. Both of them are perfectly happy on their /23 addressing scheme. Based on that, I don't think it's worth me doing here. We don't have BYOD or VOIP, we only have 4 MFD and the SAN is a totally physically separate network.

 

If your network is bigger and more complex than mine, then yes I suggest you do it.

 

When our VOIP system appears at tail end of next summer, then yes I shall VLAN off the phones because: security addressing and broadcast traffic.

[mavhc]

First step, gather data, no point doing something that makes no difference.

 

Do you have a lot of legitimate broadcast traffic? Install Wireshark, start a capture with the filter: broadcast

 

That'll get MAC broadcasts. 100s per minute is fine, that's 100 bytes/second, out of 10 million, no problem. 1000 per second would be bad.

 

Next do a capture for: host 255.255.255.255

And another for: host (whatever your broadcast address is)

 

Those 2 are probably the same as the first one.

[LytchettNM]

Completely worth doing without a doubt.

I run a largish network some 1000 ip devices, remember that everything not just computers are connected to your network and you need to account for all devices when you think about the ip ranges.

We run all subnet as /24 except for wireless, and we also use the 3rd octet as the VLAN I'd which helps if you are fault finding in the future.

We also tend to try and keep each subnet/VLAN to 100 ip's this keeps the broadcast nice a low.

Having a VLAN for saying printing, CCTV or VoIP etc means you can configure your network with all of these VLAN's presented to each switch and then only add the ports of each switch to the relevant VLAN.

If you are going add a new core switch I would also highly suggest that all of your edge switches connect directly back to this new core switch not daisy chaining from one switch to another.

[Davit2005]

Implementing vLANS is a whole lot easier on Managed switches i.e. HP or Cisco using a CLI than using a GUI.

 

You can simply do the config on one and then with some changes copy it straight to another switch It doesn't take long to implement that way.

 

Invest in a HP Layer 3 core as a starting point would be my goal then start replacing the Edge with HP's no need to go too mad at the edge switches, even 100Mb to edge device will suffice.

 

As long as you are not doing anything too special 802.1Q is standard between vendors although different terminology i.e. Cisco Access port vs HP Untagged, Cisco Trunk vs HP Tagged. etc

[altecsole]

Many thanks for all the comments and suggestions; much appreciated.

 

Is setting VLANs for buildings a good idea, rather than devices? We have approx 600 PCs so setting a VLAN for them would still result in a lot of broadcast traffic?

 

It's a pain that different vendors use different terminology when talking about VLANs!

 

Cheers

[Davit2005]

Many thanks for all the comments and suggestions; much appreciated.

 

Is setting VLANs for buildings a good idea, rather than devices? We have approx 600 PCs so setting a VLAN for them would still result in a lot of broadcast traffic?

 

It's a pain that different vendors use different terminology when talking about VLANs!

 

Cheers

 

A vLAN per building for desktops/printers could be a good starting point.

 

Broadcast wise It depends what sort of devices you have on your network, some devices i.e. printers can send a lot of broadcasts. I've seen a specific dodgy printer cause problems all printers of the same make/model printer on the same vlan. Access control, and BMS systems can be sauces of dirty traffic. then you'll want to keep any BOYD and guest traffic seperate.

[pantscat]

Exactly that - no reason why you can't split geographically and by device type.

[LytchettNM]

If your anything like us you will have computers, printers, Wireless and maybe CCTV, VoIP and BMS per building so being able to place each type of service you could say within its own VLAN works very well.

If you have some spare switches I would set these up and get your head round how you configure VLAN's before rolling out on a production network, your new core switch will also need to be configured to do your internal routing.

[altecsole]

If you have some spare switches I would set these up and get your head round how you configure VLAN's before rolling out on a production network, your new core switch will also need to be configured to do your internal routing.

 

Yes, good plan - thanks.

[mavhc]

How much broadcast traffic did you find in the end?

 

Data moving between vlans will only happen on the core switch, so you'll get more traffic to/from that switch.

 

BTW, you can auto configure all switches if they're the same make, eg using VTP https://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/10558-21.html

[bossman]

I remember when I did my MCSE a good few years ago Microsoft stated that unless you had more than 1500 devices on your network then you should have no problems with traffic and bandwith and therefore Vlans were not required, I do feel that this may be a thing of the past but surely with Fibre, the clever switches we have today and the Nics this should still be the case should it not?

 

I monitor the bandwith usage on our flat network with 400 plus computers, 100 plus Laptops and Tablets, 50 Printers, Reprographic MFDs, Digital IP phones, CCTV and Wireless running across the 1GB backbone and to be honest we are only utilising a quarter of this at peak times, we do use Cisco switches but our infrastructure is 15 years old, login times for a new profile is 25 - 35 secs and for local cached profile around 5 - 8 secs, I do think that Vlans are sometimes over used for small networks and yes I would definitely use them if I had over 1500 devices but until that time I feel everything is sorted here and has been for quite sometime.

 

Just saying like!

 

Vlans are not for everyone or every network as Security features in Windows and other OS's have alleviated the need for them from a security point. If you're having speed issues then I would look into your infrastructure for bottlenecks, Vlans just separate your traffic but still utilise the same bandwith except when using QOS on switches but this then limits the bandwith for each different protocol which in effect slows that particular protocol down or limits its bandwith so making the applications that use that protocol slower.

 

Its only my opinion and probably old hat but then what do I know hehe!

 

Happy day's

[foofighterjim]

I remember when I did my MCSE a good few years ago Microsoft stated that unless you had more than 1500 devices on your network then you should have no problems with traffic and bandwith and therefore Vlans were not required, I do feel that this may be a thing of the past but surely with Fibre, the clever switches we have today and the Nics this should still be the case should it not?

 

It completely depends on what sort of devices are connected to the network and how they communicate. For example anything with Bonjour enabled will cause a fair amount of broadcast traffic just by how it works. This is one of the reasons I make sure our printers always have it turned off.

[FN-GM]

Many thanks for all the comments and suggestions; much appreciated.

 

Is setting VLANs for buildings a good idea, rather than devices? We have approx 600 PCs so setting a VLAN for them would still result in a lot of broadcast traffic?

 

It's a pain that different vendors use different terminology when talking about VLANs!

 

Cheers

 

The best design is to keep the VLANs on 1 stack / switch and not have them span multiple switches. This will prevent the broadcast going through the uplink. However its now always practice.

[altecsole]

How much broadcast traffic did you find in the end?

 

Just over 4,000 packets per minute. That seems like a lot, but our network isn't noticeably slow.

 

Apart from restricting broadcast traffic it would be useful to have separate IP ranges to give us some more options on our firewall.

 

Thanks

[bossman]

@foofighterjim

 

Yes I do here also, plus we don't advocate the use of Apple products too much as they are a complete broadcast nuisance!!

 

This is one Manufacturer I would definitely consider Vlan's for hehe!