To V-lan or not to V-lan

[calwyn]

Hi everybody.

 

Our current network layout is a bit hap-hazard, and it had been recommended (by a company who wants the work) thas employing V-Lans would improve the network speed.

 

Currently the layout of the network consists of a couple 14 network cabinets, mostly running a single switch and feeding a zone or IT suite.

 

So, the question is what are the pros and cons in splitting the site into v-lans. Would it provide an obvious improvement in end user experience or would the expra network complexity show no real benefit?

 

Thanks in advance, Calwyn.

[Norphy]

How many devices do you have on your network? Do you have IP telephony, WiFi?

[calwyn]

Hi Norphy.

 

There are roughly 300 pcs and 50 laptops & 50 ipads connecting via wireless. We operate an old Trapeze (juniper) wireless which has 32 access points attached to the wired infrastructure. There is no Ip based phones or cctv.

 

Cheers, Calwyn

[Norphy]

How many SSIDs do you have for your wireless? Do you have separate BYOD and guest networks or do you just allow school devices on there?

[calwyn]

It's just school devices (Plus a couple of SLT phones) on a single SSID.

[Norphy]

Ok, so what about the physical layout of your site? Are you spread across multiple buildings or are you in one big building?

 

Do you have any L3 capable networking equipment already?

[calwyn]

The switches are Cisco SG-500's they apparently can be switched into "Layer 3 mode", but I haven't explored this yet.

 

The site is basically a largish single building, there are three floors but the top floor is tiny and the first floor is only on half of the site... the other half is ground floor only.

 

Calwyn

[Norphy]

OK, this is my opinion and others may disagree.

 

For 400 devices, no VOIP and a single wireless SSID, you probably won't see much in the way of performance increases by splitting up your network. It's generally recommended to have no more than 500 devices in a single broadcast domain so you're OK there.

 

From an organisational point of view, it may help a little. Having a separate IP address range per block, floor or section of the building could be beneficial as you'd be able to look at an IP address and have a better idea of where that device is located. Putting your servers, management addresses for your switches and wireless access points is a good idea as well as you'd be able to restrict access to them a little more easily. The other advantage of splitting up your network is that if one device does start misbehaving and spamming out broadcast traffic, only that segment of the network is affected rather than the entire lot.

 

I don't know much about Cisco stuff but I do know they have a habit of licensing features on their switches. If your switches are "L3 capable" but have the feature disabled, chances are you'd have to pay for a license to unlock the functionality and with Cisco stuff, that's usually on the expensive site.

 

It's probably worth having the conversation with them but don't take their recommendations as gospel. Try another networking vendor and see what they say. I recommend Switchshop, they've done good work for me recently.

[Blue_Cookeh]

I would VLAN with as little at 10 devices lol - in our school we have roughly 75 computers plus 20 staff laptops, 45 iPads, 10 IP phones and 20 CCTV cameras + servers, APs etc. We VLAN off for stuff like Guest network, security, DMZ (VPN etc)

 

It can become a pain, but it's worth it for security and simplified management - when there's a VOIP problem I know its contained to the VLAN and it's route out to the Internet for example.

[Norphy]

I’m not saying it’s a bad idea or that they’re aren’t benefits, I’m just saying that the performance of the network isn’t likely to improve significantly.

[AlanD]

OK, for just performance....you are not going to see much improvement....the same traffic goes through the switches and devices...its just segregated.

 

Now...if you were to ask me...that you wanted BYOD/Guest wireless traffic isolated from your domain/server network...then VLANs would deliver that.

 

If you were to want ipads used by students...not to be able to connect to printers....vlans might be the way to go...

 

If you wanted to keep financial and/or management team traffic separate form students ...vlans might be the way to go....

 

Or if you told me that telephone calls were crackly/intermittent...it might be because their data would be better on a separate vlan which is given priority.

 

Yes, its true that bonjour printer traffic and ...well printer traffic in general...can be surprisingly noisy....with lots of packets constantly being sent racing around your network...buty modern switches, servers, and PCs...are pretty good at handling such clutter.

 

Personnally, yes - I'd want vlans...for security/privacy/guarantee of service for VoIP etc...but if you are thinking of doing it just for speeed reasons....my guess is that you won't notice any difference.

[ricki]

I would say the benefits of planning against the extra work involved are not worth doing. I would investigate replacing your WiFi ,VoIP and CCTV and make a case for vlans then it's a no brained.

[mavhc]

Ask them for the data they've taken from your switches to prove that VLANs will help. If they don't have it then don't listen to them. People just recommend what they know without gathering data.

 

VLANs mean you have to decide which device goes on which VLAN, but how does the switch know what device you've plugged in?

 

Next problem: Now you have different virtual networks, but at some point you'd need to communicate between them, how will that work?

 

Configuration isn't that hard, if all your switches are the same make, you just tell them all to get config from a master switch. But then next week when you have to replace a switch and a different make is better/cheaper, now you're in trouble

[Simcfc73]

My networks a similar size, 300ish devices.

 

I have 3 vlans setup and I don't do any vlan routing as I use Smoothwall to dish out the IPs on the Vlans not my servers.

 

One for the guest WIFI's, one for the chromebooks and the main one.

 

Much easier to setup for me as I never got my head round the inter-vlan routing on the netgear switches.

[Davit2005]

We have a seperate vlans for most things, CCTV, BMS, Access Control, VIOP and departmental/building vlans

 

Easy to manage but we do have a very big org.

 

But personally I'd vlan if was running my own network. I'd certainly want Servers, VIOP, access control/BMS, Guest/BOYD WiFi on their own vlans.

Edited July 28, 2018 by Davit2005

[mavhc]

How would you configure connections between the VLANs?

[nicholab]

Having a vlan for Wi-fi means that you have a separate broadcast domain for this part of the network.

[mavhc]

Do you enable broadcast on WiFi? My Cisco WiFi eliminated the need for it for DHCP 10 years ago

[ITGuyWestMidlands]

How would you configure connections between the VLANs?

Using ACLs

[ITGuyWestMidlands]

Do you enable broadcast on WiFi? My Cisco WiFi eliminated the need for it for DHCP 10 years ago

Your devices will still broadcast at layer 2 and 3, though yes APs can be configured to drop any broadcasts that aren't needed, as it is still needed for DHCP, ARP and various routing protocols.

[mavhc]

Right, ACLs, but how do you configure them to make it better than not having VLANs at all.

 

AIUI to get rid of broadcasts it's programmed to forward DHCP to the server you specify, and same with ARP, it knows where every device is so doesn't broadcast, just sends the packet to the correct device. So unless you have mDNS type devices, it can block broadcast packets on wifi completely

[ITGuyWestMidlands]

Right, ACLs, but how do you configure them to make it better than not having VLANs at all.

 

AIUI to get rid of broadcasts it's programmed to forward DHCP to the server you specify, and same with ARP, it knows where every device is so doesn't broadcast, just sends the packet to the correct device. So unless you have mDNS type devices, it can block broadcast packets on wifi completely

You configure them to only allow access to the required IPs and services. As an example, (albeit a bad one in terms of security), you could allow access on your BYOD network to your DCs for DNS on port 53 only, therefore peventing any BYOD devices exploiting any known vunerabilities of any other services running, or accessing any open shares etc. It's all about reducing the attack surface as much as possible.

 

 

Yes the AP would accept the broadcast DHCP request and forward it directly to your DHCP server but where it would. normally broadcast the request to all devices on your subnet, the AP drops them. Which is all good.

 

Devices use ARP to learn where devices are, so yes, once all devices are listed in the ARP cache (client or AP) they are known, but the devices must first repsond to any broadcasts arps inorder to build up the tables. So ARP is required. APs can have client isloation enabled which will block these broadcasts and utilise APs cache instead.

 

We do the above on our guest and BYOD wifi VLANs to prevent clients talking to each other and flooding the air with broadcasts. We then use ACLs to control what other devices via IP and port, they can access on our other VLANs. I.e Papercut mobility, guest wifi portal, networked projectors, whilst keeping them well away from file servers, VM hosts, switch interfaces, finance, mis, cashless etc.

 

It's also good where if a wired client gets infected with a worm, clients in different VLANs will be more protected.

[mavhc]

A firewall would do the same thing wrt security though.

 

Firewall vs VLAN?

 

One issue is devices which don't have firewalls, IOT, door controls, cctv, generally all have terrible software that's easy to hack.

 

Printers are an interesting one, well known as computers that are rarely updated and running rubbish software, so a good place for the bad guy to live to attack the rest of the network, but also a good target for data passing through them.

 

WIFI doesn't need ARP if you're enforcing DHCP, as the WIFI controller knows what IP every device has already. Should be able to extend this to other protocols like mDNS, although the complexity increases.

 

One thing to do is make your switch management on a vlan no one else is on. Can do same with lights out server management.

 

I think worms are pretty dead at this point, on general purpose PCs anyway, last one was Stuxnet?

 

Next question to ask: How do you configure which devices are on which VLANs, and how do you stop a hacker getting onto a restricted VLAN?

[Davit2005]

Firewalls or Router on a stick INMO is not the most ideal way to do IntervLan routing. You want to do IntervLan routing on a core switch, either 2 stacked or a modular unit with dual PSU's and Controllers.

 

Firewalls are however good to seperate different networks and generally are easier to work with than ACL's on switches. So a firewall seperating BOYD, DMZ is the best route INMO you could seperate the servers with a firewall depending on the needs of the org and the budget available.

Edited July 30, 2018 by Davit2005

[mavhc]

I was thinking software firewalls, with no vlan. IP range x can connect to CIFS, IP range y cannot. Or just IPSEC your domain computers

 

If you're looking for a software router btw, vyos