Are VLANs worth the extra work?

[altecsole]

The best design is to keep the VLANs on 1 stack / switch and not have them span multiple switches. This will prevent the broadcast going through the uplink. However its now always practice.

 

Thanks. All of our separate building cables come back to a central point so I aim to have that point for my layer 3 switch with VLANs and then the switches that downlink from there will not need VLANs configured? Apart from the downlink switches that have WAPs plugged in! There's going to be a lot of planning involved!

[Blue_Cookeh]

Thanks. All of our separate building cables come back to a central point so I aim to have that point for my layer 3 switch with VLANs and then the switches that downlink from there will not need VLANs configured? Apart from the downlink switches that have WAPs plugged in! There's going to be a lot of planning involved!

 

I'd argue the way @FN-GM suggests would mean you need L3 switches on the edge too.

 

If you have a L3 core and L2 edge switches there's no reason VLANs can span multiple switches, just make sure your uplinks are solid. The other thing is we span VLANs across switches so we can get point to point links and things from one side of our building to another without relocating equipment. Not necessarily the best solution but you have to work with what you've got.

 

One step at a time.

Edited November 30, 2016 by Blue_Cookeh

[altecsole]

 

If you have a L3 core and L2 edge switches there's no reason VLANs can span multiple switches, just make sure your uplinks are solid. The other thing is we span VLANs across switches so we can get point to point links and things from one side of our building to another without relocating equipment. Not necessarily the best solution but you have to work with what you've got.

 

One step at a time.

 

Thanks. That was what I was thinking too. Cheers

[ITGURU]

I have found VLANs are best for security - I have them for VOIP, CCTV, Access Control, Out of band management etc so essentially hidden from scanners unless you know the GW being used - I have 1 switch as a gateway for all VLANs so I can change the GW on a PC to access to VLANs from one PC.

All our servers (25) and clients (1200) are all on the same VLAN with no performance issue or any other issues.

[altecsole]

All our servers (25) and clients (1200) are all on the same VLAN with no performance issue or any other issues.

 

That's interesting and mirrors our experience too. Many thanks.

[Blue_Cookeh]

The thing to bare in mind with sticking that many clients on a network is your wireless infrastructure will suffer. Each device connected to a WAP is going to have to send and receive broadcasts on that VLAN. If you have a trolley full of iPads/laptops on an AP on a VLAN with 1500 devices, you're probably going to start seeing performance degradation.

[Julian]

I am also running vlans, I have one vlan per cabinet ( 30 or 62 clients ). I find that this makes easier to fault find, when somebody tries to tidy up my network cables (broadcast storm), it also limits the number of affected computers.

[ITGURU]

I am also running vlans, I have one vlan per cabinet ( 30 or 62 clients ). I find that this makes easier to fault find, when somebody tries to tidy up my network cables (broadcast storm), it also limits the number of affected computers.

Somebody?? Surely only your IT staff have access to the cabs? Check your switches features. Ours have Loopback Detection enabled - if sockets are looped back, it automatically closes the 2 ports so network continues as normal. It will re-try after the set period (1 minute in our case), and will re-test. If it's still looped the ports will stay blocked, it not looped, both ports re-enabled.

 

I also have syslog enabled so as soon as it's done, boom I get am email saying which switch where and what ports.

[Julian]

The sockets on the wall are accessible to everybody. User X (pupil) unhelpfully disconnects the network cable from a computer. User Y (staff) tidies up lose cable, by plugging lose end into wall socket.

[Davit2005]

I have found VLANs are best for security - I have them for VOIP, CCTV, Access Control, Out of band management etc so essentially hidden from scanners unless you know the GW being used - I have 1 switch as a gateway for all VLANs so I can change the GW on a PC to access to VLANs from one PC.

All our servers (25) and clients (1200) are all on the same VLAN with no performance issue or any other issues.

 

vLANS are a good security measure, one of many you can implement. I don't think you should have client devices and servers on same network and never use vlan 1 :-) .

 

You only need a small lack of ignorance for a big lot of issues.

 

No need to go mad on vLANS. We had 2000+ devices at last place and apart from PC's and Desktop Printers which were geographically separated their were vLANs than spanned multiple areas i.e. Video Display, MFD, Access Control systems otherwise we'd have vLANs with 1 or 2 devices on them.

Edited November 30, 2016 by Davit2005

[mavhc]

With respect to Apple devices, bonjour/zeroconf:

 

They use multicast addresses, so check the multicast settings on your Wifi.

224.0.0.0/24 is a link local group, so not routed, stays on a layer 2 segment.

 

My Cisco WLC deals with DHCP and ARP itself and blocks all broadcasts to WiFi, unless configured otherwise, so that's not a problem. I assume other expensive WiFi systems do similar.

[FN-GM]

I'd argue the way @FN-GM suggests would mean you need L3 switches on the edge too.

 

 

That is incorrect. You will not need L3 at the edge.

 

If you have L2 for the edge and used my method the broadcast would go up the uplink but only the one that switch is concerned with and not send the broadcast down all the other uplinks on the network. Its not the best of ideas to span a VLAN over multiple switches but isn't the end of the world. I don't do it in any of my schools, I don't have an issue with the address space so why not.

Edited November 30, 2016 by FN-GM

[FN-GM]

I am also running vlans, I have one vlan per cabinet ( 30 or 62 clients ). I find that this makes easier to fault find, when somebody tries to tidy up my network cables (broadcast storm), it also limits the number of affected computers.

 

Enable STP and BDPU Gaurd. It would mean that the broadcast storm won't start in the first place.

[DMcCoy]

That is incorrect. You will not need L3 at the edge.

 

If you have L2 for the edge and used my method the broadcast would go up the uplink but only the one that switch is concerned with and not send the broadcast down all the other uplinks on the network. Its not the best of ideas to span a VLAN over multiple switches but isn't the end of the world. I don't do it in any of my schools, I don't have an issue with the address space so why not.

 

I usually had a unique vlan per switch for class machines, with staff on a common vlan (there were less of them, so broadcast was still reduced). A vlan on many switches isn't usually a problem, all traffic will normally be destined for the core/servers anyway, and people really should be managing windows firewall with gpo to reduce chatter. The common staff vlans meant I could put some servers behind a ACL that only staff needed to access.

 

And when using STP, it's important to assign edge ports correctly, or the tree will constantly be updating causing issues with the uplinks. It is a good idea though!

 

And for the adventurous, there are also 802.1x radius assigned vlans

[Davit2005]

 

And for the adventurous, there are also 802.1x radius assigned vlans

 

Had a play with these in a home lab assigning a different vlan depending on User security group for instance. At work we have a NAC product that does much the same thing but contained in a single box, controls access from all wireless devices including BOYD.

 

Set up a temp vlan untagged on the port with limited access so devices can get IP address and then once logged in port changes to appropriate vLAN allowing access to whatever needed. I wouldn't have the guts to do this in a production environment though unless there was appropriate multiple NAC servers etc.

Edited December 1, 2016 by Davit2005

[FN-GM]

Had a play with these in a home lab assigning a different vlan depending on User security group for instance. At work we have a NAC product that does much the same thing but contained in a single box, controls access from all wireless devices including BOYD.

 

Set up a temp vlan untagged on the port with limited access so devices can get IP address and then once logged in port changes to appropriate vLAN allowing access to whatever needed. I wouldn't have the guts to do this in a production environment though unless there was appropriate multiple NAC servers etc.

 

Did similar for my CCNP. It was a PITA to setup

[altecsole]

Many thanks to everybody for posting replies; that's been very useful.

 

The general consesus seems to be that VLANs are indeed worth it. So, with that in mind. Can anybody recommend a suitable 24/48 port Gb switch with SFP and SFP+ connectors? Something I can setup on the bench with a couple of other switches to get my head around how it will all work.

 

Many thanks.

[pantscat]

Is the idea that this will become your core switch?

[altecsole]

Is the idea that this will become your core switch?

 

Ideally, yes.

[pantscat]

To keep the costs down you could look at the HP Aruba (nee Procurve) 2920 48G - that's got static L3 routing, four GBIC ports and a couple of slots for 10G modules should you need them. It does only have a single power supply though... so that might be a black mark against it.

 

An alternative "big" core switch would be something along the lines of an HP 5406 - it's fully modular so you can add copper and GBIC ports as required, multiple power supplies, plus its throughput and backplane have much more capacity than the 2920.

 

Depends somewhat on the size of your network and how many fibre links you need.

[altecsole]

To keep the costs down you could look at the HP Aruba (nee Procurve) 2920 48G - that's got static L3 routing, four GBIC ports and a couple of slots for 10G modules should you need them. It does only have a single power supply though... so that might be a black mark against it.

 

An alternative "big" core switch would be something along the lines of an HP 5406 - it's fully modular so you can add copper and GBIC ports as required, multiple power supplies, plus its throughput and backplane have much more capacity than the 2920.

 

Depends somewhat on the size of your network and how many fibre links you need.

 

Many thanks. I've asked a couple of suppliers for suggestions but I'd much rather have recommendations from end users. Cheers.

[FN-GM]

To keep the costs down you could look at the HP Aruba (nee Procurve) 2920 48G - that's got static L3 routing, four GBIC ports and a couple of slots for 10G modules should you need them. It does only have a single power supply though... so that might be a black mark against it.

 

An alternative "big" core switch would be something along the lines of an HP 5406 - it's fully modular so you can add copper and GBIC ports as required, multiple power supplies, plus its throughput and backplane have much more capacity than the 2920.

 

Depends somewhat on the size of your network and how many fibre links you need.

 

The 2920 has SFP ports not GBIC.

 

GBIC

 

SFP

[Blue_Cookeh]

Many thanks. I've asked a couple of suppliers for suggestions but I'd much rather have recommendations from end users. Cheers.

 

I'll happily recommend the 2920. Got a couple sitting in our network and they've been 100% faultless the past year or two we've had them in. Only downtime they've had are reboots for firmware upgrades. The nice thing is they're still well supported, since Aruba took HPE's switch line up a lot of Aruba's feature set has been ported over to these switches

 

Budgeted in some 10G modules for them this year, too!

[pantscat]

The 2920 has SFP ports not GBIC.

 

GBIC

 

SFP

 

Yep - you're absolutely right. Cause of habit!

[altecsole]

I'll happily recommend the 2920. Got a couple sitting in our network and they've been 100% faultless the past year or two we've had them in. Only downtime they've had are reboots for firmware upgrades. The nice thing is they're still well supported, since Aruba took HPE's switch line up a lot of Aruba's feature set has been ported over to these switches

 

Budgeted in some 10G modules for them this year, too!

 

Many thanks.