Advice needed

[Badaz52]

Hi everyone,

 

I am looking into network segmentation at the moment, now we have segmented things in terms of making certain devices easier to identify but I want to do this properly to reduce broadcast storms and the like but I don't know if I can do it with our current equipment.

 

We have a L3 core switch, all of our other switches are L2 a mixture of HP and CISCO.

 

We have a flat network 10.0.0.0/16 with the default gateway set on all our devices to our router (which we don't manage).

 

I am testing with our CCTV cameras to start so have created a vlan (2) on the core switch and supplied a gateway address of 10.0.210.254/24 for a network of 10.0.210.0/24 and here is where I have an issue. If I am using a PC that is 10.0.55.10/16 for example I can ping the gateway of 10.0.210.254/24 but I can't ping a camera of say 10.0.210.101/24 that has a gateway of 10.0.210.254/24

 

The goal is that I want to segment as much traffic as I can to reduce broadcast storms but I still need to retain some interconnectivity. Our CCTV servers are 10.0.210.*/24 but I might want to view them on 10.0.55.10/16 for example.

[ITGURU]

Can you ping the CCTV camera using the 'ping' tool on your core switch? If not, have you correctly set the Camera port to the correct VLAN?

Sounds like you've got the PC gateway correct to ping the core switch L3 interface but either gateway of the camera wrong, or port that the camera in connected to not setup correct,.

is the camera connected to same switch or another?

[Badaz52]

Nope cant ping it, there are a couple of switches in the way but i have tagged all the ports. When i set the ip for vlan 2 on the core switch i set it as 10.0.210.254/24 but it kept the gateway of 10.0.100.156/16 which is our main router. Should its gateway be itself? For the individual vlans??

[ITGURU]

Are you mixing HP for Core and Cisco for edge switch where the CCTV is?

If using the 'ping' function from your core switch, you cannot ping the cctv, then its either because you've not tagged correctly, or the CCTV has the wrong default gateway.

 

You need to resolve that first as that is testing between core switch and cctv, and then the client PC will need a default gateway of your VLAN 1 IP on the core switch, so when you ping the CCTV IP range your core switch becomes your new gateway.

 

To assist in the past to check tagging is correct I have created an IP interface on the edge switch on the VLAN and tested ping connectivity to the VLAN IP from core to edge switch, so can troubleshoot along the link.

 

On your core switch, it's 10.x.x.x L3 entry should be pointing to 0.0.0.0 and then the switch's default gateway the IP of your sites router.

[Teudis]

If I understand you correctly your setup is something like this... ISP router >>>> L3 switch vlan1 all devices -- vlan2 cctv >>> other switches with correct vlans and trunk ports configured (hopefully).

 

1)First of all make sure your vlan2 is accessible from switch to switch I would setup a laptop with the ip range of vlan2 connect it to a vlan2 port and test each switch and ping to a know good cctv device ip.

2) Keep in mind you are dealing with L3 and L2 routing, vlans are L2 if you want inter-vlan routing then this will have to be enabled on the last switch before your ISP router... I suspect the cctv recorder will be on this switch. [i call it the core switch]

3) Personally I would not use the same ip range as your default network pick another i.e 172.16.x.x up to 172.31.x.x to give a physical separation of IP ranges this way you will not overlap with your /16 subnet. since you have a L3 switch before your ISP router you can use this switch as your default gateway for any device on your network.

4) Using this method you could have as many vlans all using the last switch [core switch] before your ISP router as their default gateway and this switch will forward any traffic bound for the internet to the ISP router. If you want routing to all your new vlans then the inter-vlan routing of this last switch would have to be setup up to reflect that. This way you will be able to access any other vlans ip range from your core network IP range, since all devices in your new vlans will be using the core switch as default gateway no static routes will be required on any outer devices all the magic happens on the core switch.

 

oh remember all uplink ports from switch to switch must be trunk ports to carry vlans.

 

assumed network topologies

 

ISP router >>>> L3 switch >>>> switch >>>> switch >>> switch [vlan2 port 5 <<< cctv cam1

 

(this topology is the best option)

 

_______________________ |>>>>>>> switch

ISP router>>> L3 core switch|>>>>>>> switch

________________________|>>>>>>> switch [vlan2 port 5 <<<< cctv cam 1

 

I hope this information helps point you in the right direction, Good luck.

Edited June 5, 2020 by Teudis

[Davit2005]

So if I get this right the desktop that you are pinging from has it's default gateway on the firewall and the CCTV vlan has it's gateway on the core router?

 

If that is the case you will need some routing on the firewall to tell it where the destination network is for one and you may need firewall rules setup for access.

 

The better way to do this would be have your CCTV on the firewall, your client vlans on the core switch, corporate WiFI (managed devices) can either be on your core or firewall and (if you have it) BOYD/Guest WiFi on firewall.

 

I suggest using a firewall to segregate sensitive traffic as it is a lot easier to restrict access on a firewall than it is to design complex ACLs on switches with less chance of leaving gaps. Firewalls are normally setup so you have to specifically allow traffic to pass between Zones/Interfaces (depending on the firewall whether it zone or interface rule based Cisco ASA5505 for instance) where as switches are more designed to let traffic pass as long as it can route it if it is a layer 3 and doing InterVlan routing.

Edited June 5, 2020 by Davit2005