VLAN - Planning/IP Ranges

[mdrabble]

Currently planning vlans and need some questions answering from people who have vlans, wifi (meraki if poss) and smoothwall setups

 

Currently taking the existing IP Range and splitting it down into small chunks.... eg.. Desktop, Servers, Printer etc.

 

My idea for the wifi vlans are as follows:

 

VLAN 100 - Wireless APs

IP: 10.16.118.1/24 (Network IP Range)

SUBNET: 255.255.255.0

RANGE: 10.16.118.0 - 10.16.118.254

HOSTS: 254

 

VLAN 130 - School Devices

IP: 10.16.117.0/24 (Network Range)

SUBNET: 255.255.255.0

RANGE: 10.16.117.1 - 10.16.117.254

HOSTS: 254

 

VLAN 110 - Staff Wifi

IP: 10.0.2.1/23

SUBNET: 255.255.254.0

RANGE: 10.0.2.1 - 10.0.3.254

HOSTS: 510

 

VLAN 120 - Student Wifi

IP: 10.0.2.1/22

SUBNET: 255.255.252.0

RANGE: 10.0.4.1 - 10.0.7.254

HOSTS: 1022

 

VLAN 140 - Guest Wifi

IP: 10.0.8.1/24

SUBNET: 255.255.255.0

RANGE: 10.0.8.1 - 10.0.8.254

HOSTS: 254

 

Meraki config - I would set up the reevant VLANs on the SSIDs etc and enable VLAN tagging.

 

On my core switch have a port tagged only allowing traffic with VLANS 110, 120 & 140 and plugged directly into a different port on smoothwall and configure this port with the vlans and get this port to use DHCP

 

So.... does this seem a sensible approach and easy enough to implement?

 

Cheers

[robyholmes]

I would suggest you try and link the VLAN ID to the IP range. So for my network I have VLAN 172.16.10 as VLAN10, 172.16.20 as VLAN 20. Makes management down the line easier. (Someone else told me this, and its true)

[Katy]

I would suggest you try and link the VLAN ID to the IP range. So for my network I have VLAN 172.16.10 as VLAN10, 172.16.20 as VLAN 20. Makes management down the line easier. (Someone else told me this, and its true)

+1 to this, I used to have that kind of layout before joining a trust, now we have multiple ranges (not all contiguous) on the trust WAN and it's very difficult to work out which VLAN a device is on just off its IP address

[mdrabble]

Cheers Guy - finally got round to finalizing things and yes makes much more sense to do it the way you suggested

[mdrabble]

Quick question - inter vlan routing..... how do i configure/check?

 

Cheers

[markwilfan]

Your core switch (must be layer 3) or router needs all vlans configured and a valid ip address. The on hp you just turn on routing.

 

On your other post sounds like you were using the 10g unifi switches as "core" switches but thought they were l2 only

[markwilfan]

To check you just ping across vlans

[mdrabble]

Using a DLink DXS-3600-32S as my core switch and Unifi EdgeLite for my edge switches.

 

I thought the DXS-3600 was full L3 capable but turns out the SI (Standard Image) version has only some L3 options. Although I am slightly confused looking at the L3 options available.

 

Routing

 

IP Helper

 

IP4 Interfaces

 

I am hoping I do not need to purchase the EI (Enhanced Image) upgrade as £2k is a bit much at the moment.

 

If I cannot use the DLink switch then I will have to use either my existing smoothwall S8 appliance or my wipe and reinstall my old Smoothwall UTM1000 appliance for routing (or spin up a VM with some kind of software routing option)

 

As a side thought..... I have an HP 2920-48G switch (am I right in thinking that is Layer 3 capable -if so could I use that instead of the Smoothwall box?)

 

Is it possible to tell from the attached images if, indeed the switch isn't capble for the L3 routing needed?

 

Cheers

Mark

Edited July 24, 2017 by mdrabble
added HP details

[Blue_Cookeh]

It looks to me like that switch should be able to do basic Layer 3 routing with directly connected networks. Can you ping between VLANs if you have a host in each one with the gateway set as that DLink switch?

 

If all else fails, then yes, you can use the 2920 switch you have as a L3 core switch, that’s what we’re using.

[mdrabble]

Cheers, I'll have another look when I get to work later.

[mdrabble]

Ok...... in need of lots of hand holding, and help..... lots and lots of help!!

 

Lets start from the beginning........ and hopefully someone can tell me what I am doing wrong.....

 

Trying to set up VLANs with IP Helpers but I've not done something right as client not getting DHCP at all.

 

I'm more at home with a switch GUI than command line - so feel free to provide CLI command if that is going make things better.

 

AD Server

• Created DHCP scope 10.16.120.0/22
  
• DNS point to windows servers
  
• Router points to DLINK switch
  

 

 

Core Switch - DLink DXS-3600-32S

L2 Features

• Created VLAN 120 and tagged Port 1/0/19 on VLAN 120 including VID and left VLAN 1 as native VLAN
  
• Set port 1/0/19 as a Trunk and allowed all VLANS
  

 

 

L3 Features

• Added IPv4 Route - 10.16.120.0 255.255.252.0 on interface VLAN 120
  
• Added IPv4 Static/Default Route - Gateway 10.16.123.254 on interface vlan 120
  
• UDP Helper (IP Helper Address) added - Interface VLAN 120 with helper address 10.16.119.250 (WIndows DHCP)
  

 

Unifi EdgeLiite

• Setup Switch IP details as follows
  
• Switch IP: 10.16.118.177 (a temp address)
  
• Subnet: 255.255.248.0
  
• Gateway: 10.16.118.55 (DLInk switch)
  
• 
  
• Created VLAN 120
  
• Uplink port Untagged VLAN 1 and Tagged VLAN 120
  
• Client port 1/0/8 - Untagged on VLAN 120 - Have tried Tagged and Exclude for Port 1/0/8 on VLAN 1
  
• Port Summary on 1/0/8 show Port VLAN ID as 120
  

 

Any help pointers (slap round the head) welcome

[mdrabble]

bump....

[Davit2005]

Is the DHCP servers default gateway the Core switch, the switch doing the Intervlan routing?

 

You'd normally jus have to set the IP address helpers on the vlans of the Core switch, set the approritate IP and subnet on the vlan, set the appropriate scopes on the dhcp server and it works.

[mdrabble]

No but the dhcp scope for the vlan ip range is.

 

I'll double check settings in the morning just in case I've missed something

[mdrabble]

Right..... here are my setting on the DLink Core

 

IP Helper

DLink-Core(config-vlan)#show ip helper

Interface   Helper-address   VRF
----------  ---------------  -------------
vlan120     10.16.119.250

 

 

IP Route

DLink-Core(config-vlan)#show ip route
Code: C - connected, S - static
     * - candidate default


Gateway of last resort is 10.16.118.55 to network 0.0.0.0

C    10.16.112.0/21 is directly connected, vlan1
C    10.16.120.0/22 is directly connected, vlan120

Total Entries: 2

 

IP Interfaces

DLink-Core(config-vlan)#show ip interface

Interface vlan1 is enabled, Link status is up
 IP Address is 10.16.118.55/21 (Manual)
 ARP timeout is 20 minutes.
 IP MTU is 1500 bytes
 Helper Address is not set
 Proxy ARP is disabled
 IP Local Proxy ARP is disabled
 gratuitous-send is disabled, interval is 0 seconds

Interface vlan120 is enabled, Link status is up
 IP Address is 10.16.120.1/22 (Manual)
 ARP timeout is 240 minutes.
 IP MTU is 1500 bytes
 Helper Address is 10.16.119.250
 Proxy ARP is disabled
 IP Local Proxy ARP is disabled
 gratuitous-send is disabled, interval is 0 seconds

mgmt_ipif 0  is enabled, Link status is down
 IP Address is 192.168.0.1/24
 Gateway is 0.0.0.0

Total Entries: 3

 

DHCP on Windows 2012r2

IP Scope - 10.16120.0 - 10.16.123.254

Subnet - 255.255.252.0

Gateway 10.16.118.55 (DLink Switch)

DNS - 10.16.119.250, 10.16.119.248

 

 

 

What am I missing???

[Katy]

Your default gateway for the DHCP scope (10.16.120.0) needs to be the core switch interface for that vlan (i.e. 10.16.120.1). Your DHCP server itself needs default gateway to be the core switch interface in its own VLAN (assuming the servers are in vlan1 so that would be 10.16.118.55). Otherwise no traffic on vlan 120 would be able to "see" 10.16.118.55 because it's on a different subnet as well as a different vlan.

[mdrabble]

I've change the Gateway address on my DHCP to 10.16.118.55 (can ping 10.16.120.1)

 

Chnaged DHCP scope so VLAN 120 gateway address is 10.16.120.1

 

Tested a VLAN'd port and still not getting DHCP address.

 

Think at this rate it may be easier and cheaper to get someone in to sort it

[markwilfan]

Have you tried drawing a picture. Sometimes that helps me.

[markwilfan]

So of you can ping across vlans now the routing is working. Look out for typos and the scope is active etc

[mdrabble]

DHCP now working on my VLANS!! - out of frustration I rebooted the core switch and edgeswitch I am using for testing

 

Something must have needed a reboot

 

Only issue now is can't ping any ip addresses or anything using DNS.......

 

Oh well will keep plodding on

[mdrabble]

Scratch that....... can ping VAN1 IP Addresses and internal DNS once I set the gateway address to the Core Switch (10.16.118.55) on those computers

 

Cant ping websites tho such as bbc and google.

 

Ran Tracert and it reaches the VLAN gateway on hop 1 and it report back as destination unreachable.

 

DNS forwarders are set to Smoothwall - Using Smoothwall.... do I have to set the internal nic to use 10.16.118.55 gateway?

[mdrabble]

didnt configure the core switch with an IP route to smoothwall..... now working on servers but not my clients

 

Halfway there......

Edited July 27, 2017 by mdrabble

[Davit2005]

On the Smoothwall you may need to put routes back to each subnet, otherwise the response may not know where to go.

[mdrabble]

Right.... still stuck....

 

On a Server on VLAN 1 - IP:10.16.119.250 NetMask:255.255.248 Gateway:10.16.118.55

 

Internet works fine & Tracert shows as expected -

 

<1ms <1ms 5ms 10.16.118.55 (Core Switch/Gateway for Server)

<1ms <1ms <1ms 10.16.119.254 (Smoothwall)

<1ms <1ms <1ms x.x.x.x (ISP etc......)

 

Client on V120

IP: 10.16.112.2 NetMask: 255.255.252.0 Gateway:10.16.123.254

 

No internet and Tracert shows the following:

3ms 6ms 6ms 10.16.123.254 (vlan gateway address)

* * * request timed out

 

Cant ping smoothwall either from the client on V120..... have added the CoreSwitch IP as Gateway for internal nic but no joy (unless smoothwall needs a reboot)

 

Sudden thought....... CoreSwitch...... what gateway address should this have? At the moment the Gateway address is Smoothwall (10.16.119.254)

Edited July 27, 2017 by mdrabble

[ADMaster]

Vlan 120 client ip and gateway are in different subnets

Mask needs to be 255.255.248.0 or with the current mask bring the gateway to 10.16.115.254

The gateway of your vlan1 is in vlan 120 ip space

You need to sort out your overlapping addresses

 

Use an online subnet calculator with cidr your looking at /22 and /21 right now

Your /21 can be made into two /22s

 

 

Also there doesn't appear to be a method to your gateways

Use .1 or. 254 and stick to it .55 is odd to me. It makes documentation easier later on

I also number the vlan to the third octet where possible

Your vlan 120 should start out at 10.16.120.0 or make it vlan 112

It just helps to keep it all straight in my opinion

 

Edit I see your switch config and dhcp scope list vlan 120 as 10.16.120 and your most recent post lists it as 10.16.112

I'll just assume typo and forget most of my post

Edited July 27, 2017 by ADMaster