How do you manage across subnets

[BroganOs]

I was reading this topic:

 

VLANS - Subnets - Security

https://www.edugeek.net/showthread.php?t=20548

 

And I’m really interested to learn how you do you manage services across subnets?

 

What I mean is, If our offices subnet is 192.168.0.0 and my pbx is 192.168.1.0 and our cctv is 192.168.2.0 and so on. How do you log into the different machines I.e the pbx and nvr from your admin machine?

 

Do you bridge them on the router?

 

Thanks a mill.

[houlta]

Depends if you are on the same physical lan, if so then you simply extend the subnet for the machine/s you wish to have visibility of the entire range.

Eg standard subnet is /24 or 255.255.255.0 this only addresses the immediate standard subnet of 256 ip's (254 hosts to be accurate), if you want to see 192.168.0.1 all the way through to 192.168.1.254 for example then you would use /23 or 255.255.254.0 this is 512 ip's.

Next size up is /22 which is 1024 then /21 which is 2048 and so on.

 

You would route between different ranges if they are site to site vpn for example and different ip ranges, eg 192.168.0.x at location A and 172.16.10.x at location B. Most router-firewalls do this automatically if they support site to site ipsec vpn tunnels.

In that case you are bridging with a router.

Here's a cisco example Configure Site to Site IPSec VPN Tunnel in Cisco IOS Router

 

Modern GUI firewalls like fortinet are far easier but the diagram is a good one imho.

 

VLANS you would split with switches using the switches as gateways for their particular configged subnet, the switch would then 'act' as a router through to the main gateway on a different subnet, so clients would 'see' the switch on their subnet as the gateway while the actual gateway would be on a different subnet which only the switchgear could see, no router necessary in that instance.

[BroganOs]

Thanks, everything is on the same physical network at the moment. (There may be a new building in a few months time though)

 

If I just extended the ip range to include different ranges I.e. 192.168.0.0 - 192.168.3.0 and moved the cctv and pbx to a new range each. Is there any security advantage?

[houlta]

Only if the students for example are assigned to a VLAN with no route to the other subnet, if you just extend the range then all devices can still see each other. You ideally just want a server/admin vlan that has the routing to see the whole range.

If you want to be really paranoid of course you literally use a separate physical network for voip etc.

See here- Basic VLAN Configuration and HOWTO - VLAN configuration on HP ProCurve 2810 Switch

[BroganOs]

Thanks, I currently have students and visitors on a separate vlan and internet provider so I’m happy with that.

 

It sounds like there might’ve no advantage to me, because of our size, to worry about moving our pbx and cctv to a different range.

[Davit2005]

You really want VOIP on it's own vlan if possible, VOIP can be extremely sensitive to noisy interfaces on the network.

 

When it comes to CCTV for privacy and security concerns this should be on its own vlan if not it's own switched network and should not be routable from normal client IP addresses.

[mavhc]

I'd put voip on a different vlan mostly because it's terribly insecure, not because of QoS. Encryption? never heard of it mate. Next you'll be wanting passwords that contain things other than numbers.

[BroganOs]

Thanks guys. I’d better get on that!

[Davit2005]

I'd put voip on a different vlan mostly because it's terribly insecure, not because of QoS. Encryption? never heard of it mate. Next you'll be wanting passwords that contain things other than numbers.

 

I have actually seen printers cause interference on VOIP systems before now. Instantly fixed by moving phone onto VOIP vLAN where it should of been anyway so it does happen. If you have access control or BMS systems these can cause a lot of dirty traffic too.

[FN-GM]

I have actually seen printers cause interference on VOIP systems before now. Instantly fixed by moving phone onto VOIP vLAN where it should of been anyway so it does happen. If you have access control or BMS systems these can cause a lot of dirty traffic too.

It's all the broadcast going on from the printer. Printers run many different discovery protocols that are constantly running. It's designed for devices can automatically discover them.

[mavhc]

I never see much broadcast traffic on my network, easy to monitor with wireshark anyway, then disable what's causing it.