DHCP and VLANS

[Shocker]

Hi everyone

 

I know this my sound like a networking 101 question but I've been playing about with this all day and wanted to see if someone could shed some light on this.

 

I want to start using VLANS for better security especially when it comes to adding in a guest wifi network and also sip based IP phones so I can use qos for the calls.

 

At the moment I have a single DHCP server which for talks sake is dealing out a single ip range 172.16.0.1 /16 and the subnet is 255.255.0.0. My question is I know this then allows me to use up to 172.16.255.255 or abouts but if I wanted to start using vlans and say:

 

172.16.0.1 - default

172.16.1.0 - vlans 1

172.16.2.0 - vlans 2

 

And so on is this possible if I used a subnet of 255.255.255.0? I would still want to keep using the single DHCP server and say put switches and servers on the .0.1 range then computers on the 1.0 range, printers on the 2.0 and IP phones on the 3.0 range.

 

For guest wifi access I am going to use a separate ip range altogether and have the firewall with DHCP handle that keeps them separate totally. But is this possible?

 

My switches are all layer 3 switches can someone please point me in the right direction or am I barking up the wrong tree trying to use the same subnet 255.255.255.0 for each vlan?

 

Thank you

[free780]

Only if you want to be limited to 254 ips per subnet/vlan.

[jb2201]

All your subnet is doing is slicing up your ip range which will let you divide it out amongst the VLANs, with that big of a range you can do a /21 (255.255.248.0) on your bigger VLANS or something , which would give you 172.16.0.1 through to 172.16.7.254 on the first VLAN and so on.

 

Your current usage of the subnet is fine but as free780 said you are limited to 254 addresses in that range with your subnet.

[Shocker]

Thank you very much. For me at the moment 254 is perfect per subnet. But will that allow me to create new DHCP scopes for those ranges with no issues?

[Shocker]

Do I need to put a option in the scopes so that they know to point back to the DHCP or anything?

[Roberto]

Thank you very much. For me at the moment 254 is perfect per subnet. But will that allow me to create new DHCP scopes for those ranges with no issues?

 

Yes. It was written to address a slightly different issue but this answer on serverfault goes into a fair bit of detail that should cover what you need.

 

Do I need to put a option in the scopes so that they know to point back to the DHCP or anything?

 

No. You will need to configure VLANs on the edge switches and you will need to consider how to route between those VLANs and you will (as covered in my serverfault answer) need to configure DHCP/BOOTP forwarders on the edge switches but you don't need configure the DHCP server itself - if you think about it, how would this work? If the clients needed an option given to them by the DHCP server to find the DHCP server then how would they ever get that option in the first place?

Edited December 12, 2016 by Roberto

[Techie2000]

Yes, that shouldn't be an issue creating your new DHCP scopes on the DHCP server. Just remember to update the IP-helper addresses on your switch; but bear in mind that if you are using your firewall to dish out IPs for your Guest WiFi range you will probably want to set the firewall as the IP-helper address for that VLAN (rather than your DHCP server).

[Shocker]

Thank you very much

 

- - - Updated - - -

 

Thank you everyone honestly today it just seemed like I was beating my head against a brick wall

[Shocker]

Thank you I will go over the servfault post but as you say the first thing the clients do will be check the switch.

[ricki]

Think this though carefully before you start if it were me I would split it like this

Curriculum staff wifi

Admin

Phone

CCTV

Guest wifi

 

And have different dhcp servers for admin , curric, guest wifi

[Shocker]

I Was Going To Split everything out so that I could have separate vlans for:

 

Cctv

IP phones

printers/scanners

Servers/switches

Computers/laptops

WiFi - domain computers

Byod - non domain joined

Guest wifi - separate DHCP server

 

Each of which would give me the 254 addresses per scope which for now would be more than enough for all of those above.

 

It's just making sure that everything talks properly. So it's just getting my head around the ip helper address on the switches (have to admit it's something I haven't done).

 

Currently the DHCP scope range I have is using a subnet of 255.255.0.0 so in order for me to change or start creating a new scope I need to look at a new ip range and subnet. Or its going to be take everything down and work on it over holiday break making sure it's working for when everyone gets back.

[Shocker]

Because of the size it could grow and the different scope ranges I will probably put a 2nd DHCP server in just in case something happened to the main one.

[Techie2000]

Just a note for reference - depending on your switch, IP-helper address may be called DHCP relay. Something which tripped me up a few years ago.

[Shocker]

Thank you techie2000 from what I was reading the ip helper came up allot with Cisco equipment. I am going to login and take a look at switches now to see if it's exactly as you say DHCP relay. Thank you for that tip

[Shocker]

100% correct techie it's on mine as layer2 DHCP relay the switch supports layer 2 and has a couple of layer 3 features but for vlan it's layer 2 DHCP relay

[ricki]

Be careful you don't make it too complicated use the kis approach keep it simple. You are going to make your life hard work

[Aaron]

thank you ricki oh I understand this will mean allot more additional work for setups but i am hoping that it will also improve reliability especially on the IP phones.

 

At the moment because it’s all covered under a single large subnet and the phones are not vlan off the QoS is not great so this is also another reason why i would like to get this working as well as the new wifi network I am installing.