Setting up VLANs

[it332211]

Hi All,

 

I am trying to get my head around VLANs and can do with some pointers/advice. Currently I have a “flat” (no VLANs) network with Cisco 200/500 switches, 3 computer rooms with some printers and other wired PCs dotted around; Ruckus wireless with internal and guest (BYOD) networks and few IP CCTV cameras (nothing major). In the next 12-16 months we are planning some changes, not as much on wired network but more wireless devices (Chromebooks and laptops – will get to about 700+), new IP CCTV and new VOIP phone system.

 

Obvious choice is to set three VLANs – computer network, CCTV and VOIP. There are plenty of guides and tutorials for setting them up, I already started testing it, and it works fine. But I’ve got couple of questions:

1 - Should I separate wired and wireless networks? If not, then all is fine, if yes then second question

2 – When I create different VLANs, the networks become completely separate from each other. So what do I need to do if I what to login to the domain or access printer/Internet (server/printer/proxy are on wired VLAN) from my wireless VLAN or if I want to connect from my PC (wired VLAN) to CCTV controller (CCTV VLAN) and VOIP controller (VOIP VLAN)?

 

If my understanding correct that I would have to route my traffic through Router or Layer 3 switch (it looks like there are advantages and disadvantages for both but I am leaning towards a switch as it doesn't need to strip the packets and a bit faster)? Does every switch have to be layer 3 or just one? Would Cisco Catalyst 3560-CX be good enough or do I need something different?

 

Or am I missing something and need a different approach?

 

Thank you for your help.

[Chris_Cook]

How many wired devices currently?

 

I would do separate VLANS for wired devices, wifi, cctv and voip.

 

You will need a router or L3 switch to connect these vlans. You could have one for each vlan, but its far easier to do it all on one device. For our HP switches, we just added a virtual interface for each vlan on the core L3 switch. it then did the routing table for us. Cisco might be more involved, but I'm sure there is something online about it. If you're heavy cisco users, it might be worth looking at their training.

 

You will also need to divide up your ip address range or get another range for each new vlan. Its worth thinking about how much expansion you will have over the next 5 years or so - don't make your subnets to small. If you divide your IP range, you need to update your subnet masks and other settings accordingly. This will be both on your DHCP server, and any statically configured devices.

 

You will also need to do something for DHCP, and forward DHCP requests to your dhcp server.

 

One of the first things I would recommend for this is a complete audit of your network - diagrams, maps, what switches you have, number of devices etc.

[mavhc]

Everything that wants to go between VLANs has to travel to a L3 switch, so if you're not careful that's a bottleneck.

 

Monitor current usage on your switches, gather data.

 

As CPUs are fast and cheap now a L3 switch doesn't have to cost way more, might still do if the maker of the switch likes to make lots of profit of course.

 

Note the backplane bandwidth, for L3 and L2.

 

Reasons to have VLANs: a) security, b) to reduce broadcast traffic.

 

Monitor how much broadcast traffic their is. For Wifi the controller should be filtering it out and redirecting it as needed.

 

Make sure you can configure the whole system at once, not have to log into each device and add a vlan, or change an ACL

[it332211]

Thanks for quick reply. Yes, currently going through the switches (updating firmware and mapping - amazing how long it takes!). We have around 300 devices on wired (PCs and printers). I think first step is to get that Layer 3 switch, run some test during Easter, ready for Summer switch-over.