Network VLAN best practice/advice. HELP!!! PLEASE!!! :D

[Dan_ATR]

Hi chaps.

 

Next week I am reconfiguring my network of 4 Cisco L2 managed switches. As I have the latest updates, I can use one of these switches as a L3 switch for intervlan routing which is awesome. (extra bandwidth)

 

Now, what I am trying to learn is what is best practice/recommended for VLANing. I am going to have the domain on one VLAN, CCTV on another with two different subnets/ip ranges.

 

I know that you should disable VLAN1, have a management VLAN for the switches and alike, but should I have the management VLAN on its on IP range or should I include it on the domain VLAN? If its on its own IP range, then does the router need to know about this IP range as well? becouse if it does, then im stuffed.

 

Also my ISP have stated that I should only use the two ranges I have been provided so that they can access the internet. Can I not use other IP ranges for domain/device VLANs like for printers, wireless and alike as well?

 

I really could do with being in a room right now with a couple of CCNA people, with a big white board and pens, so I can show them as a drawing what I want to achieve and then let them educate me as to what I need to do lol.

 

I am willing to phone people and talk over the phone as well and learn.

[Blue_Cookeh]

Does your ISP dictate to you what IP addresses you can use? If you're planning on using your switch for inter-VLAN routing then your switch becomes the default gateway for all your network devices, and your Internet router becomes the default gateway for your L3 switch.

 

Unless you have a funky setup and your ISP dictates your internal address ranges (such as SchoolsBroadband's cloud filtering) then it's of no concern what ranges you use internally.

 

From what you said in your post, you're going about it the right way. Different VLANs for different purposes with different subnets. Make sure you use ACLs on your L3 switch to stop people from accessing your CCTV network for example, too.

[FN-GM]

What are the ranges that your ISP say you must use? You will be able to subnet these down and make multiple VLANS.

 

The management VLAN doesn't really matter technically. It depends on how you want to organise things really.

[Dan_ATR]

Does your ISP dictate to you what IP addresses you can use? If you're planning on using your switch for inter-VLAN routing then your switch becomes the default gateway for all your network devices, and your Internet router becomes the default gateway for your L3 switch.

 

Unless you have a funky setup and your ISP dictates your internal address ranges (such as SchoolsBroadband's cloud filtering) then it's of no concern what ranges you use internally.

 

From what you said in your post, you're going about it the right way. Different VLANs for different purposes with different subnets. Make sure you use ACLs on your L3 switch to stop people from accessing your CCTV network for example, too.

 

Yes, we unfortunitly have a filtering system that needs to be on a perticular IP/subnet range which sucks.

 

If had it my own way, I would have 10.152.*.*/21 range or somthing. Then I could use a 10.152.16.* for lets say printers, 10.152.17.* for CCTV, 10.152.18.* for servers, and alike.

Edited December 9, 2016 by Dan_ATR

[FN-GM]

Yes, we unfortunitly have a filtering system that needs to be on a perticular IP/subnet range which sucks.

 

If had it my own way, I would have 10.152.*.*/21 range or somthing.

 

Can you post the IP Range / Subnet they have provided please? You might have more wiggle room than you think.

[Dan_ATR]

10.152.18.*\23

and

10.85.8.*\24

Edited December 9, 2016 by Dan_ATR

[Blue_Cookeh]

10.152.18.*\23

and

10.85.8.*\24

 

How many devices do you have? In my situation I could carefully carve those up and get away with it but a larger school couldn't. Maybe use the /24 for your domain network and then carve the /23 up for your CCTV etc if there's enough addresses to go around.

 

Your other option is to request more from your ISP.

Edited December 9, 2016 by Blue_Cookeh

[Dan_ATR]

How many devices do you have? In my situation I could carefully carve those up and get away with it but a larger school couldn't. Maybe use the /24 for your domain network and then carve the /23 up for your CCTV etc if there's enough addresses to go around.

 

Your other option is to request more from your ISP.

 

I have around 200 IP issued devices including printers, APs, servers etc...

[Dan_ATR]

Either everyone has come off lunch of have all run away lol. Edited December 9, 2016 by Dan_ATR

[ITGuyWestMidlands]

You need to list the vlans you would like and provide details on how many ip addresses you will need in each vlan. We can then subnet your existing ranges to your requirements

[Dan_ATR]

ok,

 

I need to disable the default VLAN1, and assign the switches with a new one.

I need a switch management VLAN on a non-internet based IP range i.e., 192.168.*.* with minimum of 7 IPs

I need a CCTV VLAN that is on my 10.85.8.*\24 range. - (Needs internet access)

 

On my 10.152.18.*\23 range:

I need a Network Domain VLAN with 255 IPs. - (Needs internet access)

Printers VLAN with a minimum of 7 IPs with some room for expansion. - (Needs internet access)

Phones VLAN with a minimum of 26 IPs with room to take it to around the 30 IP mark. - (Needs internet access)

 

I was thinking about a Guest Wi-Fi VLAN with something like 50 free IPs but after doing some research I don’t think I can have the Domain VLAN and a Guest WiFi VLAN running alongside each other over the Ruckus kit we have. - (Also needs internet access)

 

With the VLAN numbering, any suggestions?

Example of what I might do:

default VLAN 05 for management. 192.168.1.0\28 192.168.1.1 - 192.168.1.14 14 IPs

VLAN 10 for data/servers. 10.152.18.0\24 10.152.18.1 - 10.152.18.254 254 IPs

VLAN 20 for vistors Wi-Fi to provide external internet access only. 10.152.19.0\26 10.152.19.1 - 10.152.19.62 62 IPs

VLAN 30 for voice, Enable QoS for the voice VLAN. 10.152.19.64\26 10.152.19.65 - 10.152.19.126 62 IPs

VLAN 40 for Printers. 10.152.19.128\28 10.152.19.129 - 10.152.19.142 14 IPs

VLAN 50 for Security/Video. 10.85.18.0\24 10.85.18.1 - 10.85.18.254 254 IPs

Edited December 12, 2016 by Dan_ATR