Trust Network - IP Addressing

[Asgard]

So I'm now in the planning stages of building our trust network... and one of the institutions is basically too complicated to even consider flattening or doing any major work to.... so

 

My plan is to have a top level trust AD domain, and all member institutions will have a trust relationship to - I've seen comments that a few edugeek members have their setup this way.... my thoughts now turn to the IP addressing.

 

How do others basically sort out their IP addressing;

 

I was thinking of moving to something like this;

 

I just wonder if I'm massively overcomplicating it.

 

[b]10.30 -           Academy Trust[/b]
Core Switch will be 10.30.1.1

10.30.1.x     -              Trust Servers

[b]10.40 -           Institution 01[/b]
Core Switch will be 10.40.1.1

10.40.1.x		-              Servers
10.40.2.x		-              Switches
10.40.3.x          -              Printers

[u]10.41 Range   [/u]    
10.41.x.x		-              Clients in a VLAN that has >600 devices

[u]10.42 Range[/u]
10.42.10.x                                            -              Current VLAN 10
10.42.11.x                                            -              Current VLAN 11
10.42.12.x                                            -              Current VLAN 12
10.42.13.x                                            -              Current VLAN 13
10.42.14.x                                            -              Current VLAN 14
10.42.15.x                                            -              Current VLAN 15
10.42.18.x                                            -              Current VLAN 18
10.42.19.x                                            -              Current VLAN 19
10.42.20.x                                            -              Trust WiFi SSID (for Central Staff)
[u]10.43 Range[/u]
10.43.x.x			                    -              Institution Wireless (Current VLAN16)
[u]10.44 Range[/u]
10.44.x.x			                    -              Eduroam BYOD (Current VLAN20)
[u]10.45 Range[/u]
10.45.x.x                                      -              Access Control/CCTV/Door Entry


[b]10.50 -           Institution 02[/b]
Core Switch will be 10.50.1.1

10.50.1.x		-              Servers
10.51.2.x		-              Switches
10.52.3.x          -              Printers

[u]10.51 Range[/u]
10.51.x.x 	            -              Large Scope
[u]10.52 Range[/u]
10.52.10.x                                            -              Current A Floor VLAN
10.52.11.x                                            -              Current B Floor VLAN
10.52.12.x                                            -              Current C Floor VLAN
10.52.13.x                                            -              Current D Floor VLAN
10.52.14.x                                            -              Current Access Control VLAN
10.52.15.x                                            -              Trust WiFi SSID (for Central Staff)
[u]10.53 Range[/u]
10.53.x.x		                                    -              Institution Wireless
[u]10.54 Range[/u]
10.54.x.x			                            -              School BYOD
[u]10.55 Range[/u]
10.55.x.x			                            -              Access Control / CCTV / Door Entry

Edited May 25, 2017 by Asgard

[Fazza]

That's pretty much how we did it when I worked in FE and we had 5 LANs all linked together via microwave links to form our WAN.

[Asgard]

Cheers Fazza

Pretty much ironed it out today

[ninjafish]

Ensure you know the plan for adding any future establishments in and that you don't limit yourself to pay small number of establishments before having to change your IP structure.

[Asgard]

Ensure you know the plan for adding any future establishments in and that you don't limit yourself to pay small number of establishments before having to change your IP structure.

 

The current plan can scale to 19 institutions based on them all needing a block of 10in the second octet

 

So

 

10.40 for institution one

10.50 for instruction two

 

However dependant on size of institution joining we could make it go further by having

 

10.50.1-5 institution 2

10.50.6-9 institution 3

 

Some of them are not going to be as complex as the main institution so won't need as many permutations

Edited May 26, 2017 by Asgard

[LytchettNM]

So looking at just the IP side of things a simple but flexible IP structure has got to be a baseline for today's MAT networks imo.

Something like this:-

Site 1 10.0.x.x

Site 2 10.1.x.x

Site 3 10.2.x.x

Etc.

We use VLAN/subnet to keep broadcast under control and again to keep things simple we use the third octet to reflex the VLAN id which can make fault finding easier and standardise network configuration across all sites.

So if you have a server solution at each site you could use the same VLAN/subnet at each site for servers and another for network management etc, this will help from a network support prospective and for that matter setting up ACL's which you can use to block student and staff networks from having access to building or switch management etc.

I find the key to an efficient / stable network is to keep broadcast under control, use spanning tree, standardise the way networks are structured and restrict who has access to make changes to the core / edge networks.

[Asgard]

Yeah so that's pretty much how we have planned it....

 

But can't use anything 10.0.x.x - 10.20 at present because the main college uses that as it's structure

 

So settled on this (90%ish accurate as I am typing it up properly)

 

 

Will just essentially mirror the ACLs we have in place already to restrict access to the BMS/CCTV/others subnets.

 

The trust core switch is setup and institutions 1 and 2 both have their core switches setup and now there are rules preventing talk between the institutions only from

Institution to the upper trust network.

 

The reason for large scopes on the left is that some of our existing vlans have more than 250 clients and splitting them up just seems a bit of a back step as they are all outer buildings so location based vlans

 

It's a shame that just prior to us taking over a school, they signed a 5year deal on printers and WiFi so my plan of extending our Ruckus over to them is on hold sort of.

Edited May 28, 2017 by Asgard

[LytchettNM]

We also standardise on things like all gateways they are all x.x.x.254 and most networks are a /24 network aiming to use about 100/120 ip per scope and devices that need a fixed IP they start from x.x.x.201 within the subnet they are within, printers, switch management, CCTV etc are in their own campus wide VLAN/subnet and things like WiFi we then use a /22 network.

[LytchettNM]

Yeah so that's pretty much how we have planned it....

 

But can't use anything 10.0.x.x - 10.20 at present because the main college uses that as it's structure

 

So settled on this (90%ish accurate as I am typing it up properly)

 

[ATTACH]43470[/ATTACH]

 

Will just essentially mirror the ACLs we have in place already to restrict access to the BMS/CCTV/others subnets.

 

The trust core switch is setup and institutions 1 and 2 both have their core switches setup and now there are rules preventing talk between the institutions only from

Institution to the upper trust network.

 

The reason for large scopes on the left is that some of our existing vlans have more than 250 clients and splitting them up just seems a bit of a back step as they are all outer buildings so location based vlans

 

It's a shame that just prior to us taking over a school, they signed a 5year deal on printers and WiFi so my plan of extending our Ruckus over to them is on hold sort of.

 

Having looked at you whiteboard [emoji106] it very wasteful of IP ranges if I've understood it correctly, you have 10.40.x.x showing BSFC but after 10.40.6.x or then jumps to 10.41.x.x assuming that this is not the first of your other sites I would not do that.

[Asgard]

Yeah take your point but at least two of the existing vlans have (vlan9 - revised .41 has circa 485 machines in it. VLAN 12 has just under 380 so will need an expanded range. The rest of them have between 80-300 devices on them.

 

These are two buildings and it just seems daft to split them into vlans so essentially we would need a VLAN per floor for a building.

 

The 10.40.x ranges will each have less than 250 devices in so that's why they are split and we can ACL them and keep them secure and logical across institutions.

 

Even our 10.49 range is our BYOD / Eduroam and on average we have about 1300 users on it. Just checked and the BYOD dhcp shows 1459 and that's with a 30 day lease.

Edited May 28, 2017 by Asgard

[LytchettNM]

Yeah take your point but at least two of the existing vlans have (vlan9 - revised .41 has circa 485 machines in it. VLAN 12 has just under 380 so will need an expanded range. The rest of them have between 80-300 devices on them.

 

From a broadcast point of view I would keep to around 100/150 IP's per subnet.

 

These are two buildings and it just seems daft to split them into vlans so essentially we would need a VLAN per floor for a building.

 

A VLAN/subnet per floor sound like a better plan to me.

 

The 10.40.x ranges will each have less than 250 devices in so that's why they are split and we can ACL them and keep them secure and logical across institutions.

 

ACL's are good but make sure you document what you have in place.

 

Even our 10.49 range is our BYOD / Eduroam and on average we have about 1300 users on it. Just checked and the BYOD dhcp shows 1459 and that's with a 30 day lease.

 

I would expect BYOD to be a large subnet so that's not an issue, 30 day lease that sounds a little long to me we run a 6 day lease and auto scavenge every 4 days with 4 day update.

 

Keeping DHCP and DNS heathy make for a stable network especially if the network grows.

[Asgard]

30 days is only on BYOD to ensure it's easier to report on student internet activity. But each to their own I suppose

[LytchettNM]

I like that idea. I think I might take that one on myself thank you.

[Asgard]

I like that idea. I think I might take that one on myself thank you.

 

Just seems quicker for us to be able to find the user in radius/wireless controller and then jump on our Sophos UTM and pull the logs.

 

We toyed with the idea of having it all in SQL but put it on back burner.

 

Good thing for us is that the new XG variant of the Sophos UTM can pull the radius logs in so your looking in one place - or that's what Sophos are saying anyway.