To V-lan or not to V-lan

[calwyn]

With the exception of the WIFI, we have no other services going through the network, and the WIFI is only working to connect our laptops to the network.

[mavhc]

Wouldn't bother with VLANs then, ask the company for their analysis of the data they've captured from your network, and what percentage improvement you'll see, and what calculations they used, and what are the downsides of moving to VLANs.

[calwyn]

Wouldn't bother with VLANs then, ask the company for their analysis of the data they've captured from your network, and what percentage improvement you'll see, and what calculations they used, and what are the downsides of moving to VLANs.

 

They didn't capture any data at all, their analysis of our network involved a ping test and a 200mb file download. The benefits of them configuring VLans on our network would be that they get paid for the job.

[mavhc]

Exactly, tell them to go and scam an evil oil company instead of a publically funded school, and follow them out the door with a bell shouting Shame!

[Davit2005]

I was thinking software firewalls, with no vlan. IP range x can connect to CIFS, IP range y cannot. Or just IPSEC your domain computers

 

If you're looking for a software router btw, vyos

 

vYos is quite good, you can use vrrp to give some redundancy if you put a vyos instance on 2 seperate virtual hosts/hardware. However the acl on vyos is a bit complicated from what I have seen.

[colly72]

My preference would be to VLAN. If you already have a layer 3 core switch, then it's well worth doing for future proofing your network, from a performance, security and organisational point of view. For the time investment now, you can set your network up for years to come.

[RobD]

The switches are Cisco SG-500's they apparently can be switched into "Layer 3 mode", but I haven't explored this yet.

 

 

 

Just for info when you enable layer 3 mode on a SG300 it wipes the entire switch so make sure you have a backup first!

[Geoff]

I consider that VLANs are mandatory for any modern network. You just can't effectively manage your traffic otherwise. Either for performance or security.

 

However beyond VLANs it is worth considering that it is best practice these days to push layer 3 as far down towards your network edge as possible. Mainly to avoid tedious STP issues and use OSPF to handle redundant routes. Ideally you want to layer 3 subnet all the way down to your individual cabinets or even switch level. If your network spans more than one building you should seriously consider this approach.

 

Here's a good overview by Cisco that would be relevant to a lot of readers here.

 

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/routed-ex.html

[Davit2005]

I consider that VLANs are mandatory for any modern network. You just can't effectively manage your traffic otherwise. Either for performance or security.

 

However beyond VLANs it is worth considering that it is best practice these days to push layer 3 as far down towards your network edge as possible. Mainly to avoid tedious STP issues and use OSPF to handle redundant routes. Ideally you want to layer 3 subnet all the way down to your individual cabinets or even switch level. If your network spans more than one building you should seriously consider this approach.

 

Here's a good overview by Cisco that would be relevant to a lot of readers here.

 

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/routed-ex.html

 

This is the model we are working toward. At the moment we use OSPF between 4 layer 3 switches in seperate buildings with VRRP used on specific vlans and multiple mstp instances. But soon hopefully we shouldn't need vrrp or spaning tree at the core which will make things a bit easier.

[mavhc]

Note that that's a solution at a completely different scale to the original poster

[Geoff]

Yes, as I said. If you in a single building it's overkill.

[ITGuyWestMidlands]

The general advice from this thread is that for most, VLANs for managed devices is useful for organisation and management purposes, and does offer some security benefits. However, they do add a level of complexity that may not be suited to all schools. Layer 3 at the edge is considered the future, though depends on requirements, size and complexity of the networks.

 

For wifi, there are some performance benefits in placing managed (domain joined) wireless devices on there own vlan. Though more strongly, the general recommendation (on here and in industry) is that VLANs should be put in place for guest and BYOD networks due to the segreagation they introduce from you main production network.

 

If you want to go with VLANs, look at using a on a L3 core switch to do the bulk of your inter-vlan routing and ACLs internally, but for Guest and BYOD, use your firewall instead.

[Davit2005]

The general advice from this thread is that for most, VLANs for managed devices is useful for organisation and management purposes, and does offer some security benefits. However, they do add a level of complexity that may not be suited to all schools. Layer 3 at the edge is considered the future, though depends on requirements, size and complexity of the networks.

 

For wifi, there are some performance benefits in placing managed (domain joined) wireless devices on there own vlan. Though more strongly, the general recommendation (on here and in industry) is that VLANs should be put in place for guest and BYOD networks due to the segreagation they introduce from you main production network.

 

If you want to go with VLANs, look at using a on a L3 core switch to do the bulk of your inter-vlan routing and ACLs internally, but for Guest and BYOD, use your firewall instead.

 

This is more like what we done at a previous employment. This way you can deal with BOYD and Guest at the firewall level and it should not have any connection to any other Zone/Network unless you tell it to. Which is a whole heap easy than dealing with all the complicated ACLs on switches that would be needed for simple services such as DHCP.