Vlans

[kevin_lane]

So looking at vlans as we are now moving away from our ISDN30 line

 

And now need to make a jump to vlans

 

I don’t want to create a vlan for everything just want to keep it simple

 

And wondered what other schools do, I presume it’s going to be along the same lines

 

But I’m thinking - as a starter

 

Vlan10_Voip

 

Vlan20_GuestWifi

 

Vlan30_Staff

 

Vlan40_Pupils

 

Vlan50_MainWifi (or something of that description)

 

I’m trying get a lot of design work done before I implement this, before “any gotcha” issue come up.

 

Any suggestions would be appreciated

[Steve21]

Regarding your staff/pupil ones, assuming that's based on computers etc not wifi, personally I'd do those per "areas"

 

If something "bad" happens in block1 for staff, that design would still replicate the "badness" across your entire network.

 

Also infrastructure/servers etc on it's own one is my preference

 

Steve

[mrbios]

Printers, wifi ssids, voip, vlan for servers/infrastructure. That's a good base setup. Personally my site is split into 6 separate sections in 5 buildings so each section is a separate vlan.

 

I wouldn't bother with staff and pupils on separate vlans, that just feels like a lot of management for not real benefit.

[FN-GM]

Printers, wifi ssids, voip, vlan for servers/infrastructure. That's a good base setup. Personally my site is split into 6 separate sections in 5 buildings so each section is a separate vlan.

 

I wouldn't bother with staff and pupils on separate vlans, that just feels like a lot of management for not real benefit.

 

Agree with the above.

 

I would make the printer vlan for use with any devices with a static IP.

 

I can’t see any benefit at all of separating staff and students.

[Norphy]

I’ve got separate data VLANs per building or per hub room in the single building schools. Makes it easier to identify where traffic is coming from, plus keeps the size of the collision domains down.

[ITGURU]

VLAN 1 is for everything on main network clients, printers, copiers, etc

Separate VLANs for:

Access Control

Guest WiFi

VOIP

MGMT Interfaces i.e iLO, iDRAC, UPS etc

[kevin_lane]

Definitely gives me something to think about thanks

[uccert]

Seriously! How big is your network? That’s a terrible way to design and manage your network. Your whole network is just one large collision domain.

 

And from a security perspective you have no network segmentation so any pupil can access your staff devices and servers.

[uccert]

I disagree with all of this. You need to be segmenting your networks as much as possible. Your staff and pupil devices don’t need to communicate with each other. Your pupil devices don’t need to have access to your SIMs servers.

 

You need to be implementing ACLs on your network to stop an attacker from flowing laterally around your network. You should at least be making it more difficult for them!

[Boredguy]

I disagree with all of this. You need to be segmenting your networks as much as possible. Your staff and pupil devices don’t need to communicate with each other. Your pupil devices don’t need to have access to your SIMs servers.

 

It depends what they are classing as staff/pupil devices.

If it's workstations then there is no reason why you would want to have them in different vLans as it should be a case that a member of staff can logon to any workstation to get work done, and the same with a student.

 

If it's 1:1 laptops, or ByOD then not being able to communicate is a valid reason.

 

Don't forget of course that some of the classroom management solutions in use might require access between staff/student station if it does not all go via a server so it does depend on each sites requirement

[localzuk]

I disagree with all of this. You need to be segmenting your networks as much as possible. Your staff and pupil devices don’t need to communicate with each other. Your pupil devices don’t need to have access to your SIMs servers.

 

You need to be implementing ACLs on your network to stop an attacker from flowing laterally around your network. You should at least be making it more difficult for them!

 

ACLs are NOT a good security mechanism for inter-vlan security. There is voluminous information out there saying why VLANs should not be used for security purposes. Spoofing VLAN tags is super simple. Switches are not firewalls, and VLANs are for traffic management, not security.

 

Your comment about keeping staff and pupil devices apart also ignores the reality of how things work in many schools. Here? We use our IT suites to train staff as well as teach lessons. We've had 30 people being trained on SIMS in an IT Suite. Teachers use classroom control tools to view pupil machines. Staff use any PC available to access their email and files, should they not be one of the staff issued with a laptop.

[TechMonkey]

It depends what they are classing as staff/pupil devices.

 

Yeah this. There are very few workstations here that are purely used by only staff or students. The only places might be some offices but then something odd would happen like a pupil would need to do a test in an empty office. Personal devices though should be dumped into a completely seperated VLAN and shot straight out to the internet.

 

We would be cutting our provision for staff or pupils dramatically if we marked stations as only for one set or the other.

 

Yes we need to be secure but we have to remember we are not a military facility, the network needs to be useable. It is a fine line but being black and white won't serve the school well.

[jthompson]

On the subject of separating staff and student devices, we have a number of staff machines (PCs in most offices and teacher laptops) where we use Group Policy to restrict student accounts from logging in to those devices. They inhabit the same VLAN on the school network. At the first school I worked at, staff and pupil machines were on entirely separate domains, which I think was the fashion for a while. Too many reasons not to do that though, now.

[bald_pig]

Seriously! How big is your network? That’s a terrible way to design and manage your network. Your whole network is just one large collision domain.

 

And from a security perspective you have no network segmentation so any pupil can access your staff devices and servers.

 

I disagree with all of this. You need to be segmenting your networks as much as possible. Your staff and pupil devices don’t need to communicate with each other. Your pupil devices don’t need to have access to your SIMs servers.

 

You need to be implementing ACLs on your network to stop an attacker from flowing laterally around your network. You should at least be making it more difficult for them!

 

If this is how you plan on advertising your business to us, I wouldn't expect much uptake...

[howartp]

If this is how you plan on advertising your business to us, I wouldn't expect much uptake...

 

From his profile:

[Boredguy]

So looking at vlans as we are now moving away from our ISDN30 line

 

And now need to make a jump to vlans

 

I don’t want to create a vlan for everything just want to keep it simple

 

And wondered what other schools do, I presume it’s going to be along the same lines

 

But I’m thinking - as a starter

 

Vlan10_Voip

 

Vlan20_GuestWifi

 

Vlan30_Staff

 

Vlan40_Pupils

 

Vlan50_MainWifi (or something of that description)

 

I’m trying get a lot of design work done before I implement this, before “any gotcha” issue come up.

 

Any suggestions would be appreciated

 

First major question, and one I'm sure you've already got covered is do you have a Layer 3 on your core switch to allow routing between the vLans, or were you just wanting to stick with layer 2 with no communication between them.

 

If you have Layer 3, then as some have suggested (and depending on the layout of your site) you might want to look at also creating vLans for different buildings/cabinet locations to reduce the domain collisions.

 

We have dedicated vLans for CCTV, VOIP (when we get round to upgrading the phones), ByOD WiFi, VPN as well as the main network.

[uccert]

If this is how you plan on advertising your business to us, I wouldn't expect much uptake...

 

Good Morning - this was all meant with the best intentions but has clearly gotten a few backs up. I'm not going to try and backtrack and make amends etc. The vast majority of the networks we see day in and day out are quite basically a mess. No documentation, flat networks etc... How can you protect something if you don't know whats on your network.

 

I'm not saying every school is like this, far from it. There are clearly some technically sound people on this board who are up against the kosh in terms of budgets, time etc. We've only gone into a single school in the last 2-3 months where they truly made it difficult for us to get onto their network and I was pleasantly surprised.

 

Have a good day everyone.

[MatthewL]

We have our server VLAN and various ones around that, each site has its own VLAN, internet only (guest wifi as such), voice, security systems. For me on a school site each building or area would be its own VLAN, don't segregate staff or students don't see the point. Areas that are heavy on network such as media put them on their own, if you wanted segregate off the admin office, printers are a must but only if you install your printers on a server and share off that way no direct printing and if using a print management you can keep control.

 

Don't make it too complicated so that you are changing switch config all the time, we are just putting in 802.1x policies that will allow certain domains on but then chuck everything else on internet only.

[TechMonkey]

Good Morning - this was all meant with the best intentions but has clearly gotten a few backs up. I'm not going to try and backtrack and make amends etc. The vast majority of the networks we see day in and day out are quite basically a mess. No documentation, flat networks etc... How can you protect something if you don't know whats on your network.

 

I'm not saying every school is like this, far from it. There are clearly some technically sound people on this board who are up against the kosh in terms of budgets, time etc. We've only gone into a single school in the last 2-3 months where they truly made it difficult for us to get onto their network and I was pleasantly surprised.

 

Have a good day everyone.

 

Unfortunately that is confirmation bias though, the schools that have called in a security/network consultant probably know they need help and have issues. Also from your posts on here it seems you are aiming for complete lockdown, which is not practical in a school. The term "get on to their network" is a very broad term. Things like locking ports to MAC addresses or setting up systems where a new device has to have authorisation are a lovely ideal but less than practical and usually only implemented in Colleges and Universities.

 

More practical observations or tips would be well and gratefully received but a combative attitude and swiping at others will never go down well here.

[JackCPickup]

Too add to this I'd suggest a management VLAN so you aren't managing your network in another collision domain.

[Davit2005]

Wish we could lock down edu like non-edu org but it seldom happens (push from curriculum, budget, time, training, etc. ). And the higher up you go in edu the more difficult the balance is in keeping research pretty open but maintaining a secure environment.

 

Defo not saying we should give up but there needs to be a workable balance whilst protecting sensitive information and systems. Patching, MFA, user awareness, desktop/server/infrastructure hardening, lateral movement limitations, best practices for vlans, rule of least privilege account practice, etc. should all be employed.

 

Whilst vlans can be employed and if best practice used i.e. not having client/server vlans untagged/native on uplink ports, specifically defining vlans on ports and not leaving as auto or vlan 1, disabling lldp and cdp where necessary, etc. As well as management locked down and physical security around network infrastructure. IMO vlans if configured following best practice still have their place but are jus one part of the picture.

Edited June 18, 2021 by Davit2005

[Oaktech]

I can’t see any benefit at all of separating staff and students.

 

Neither can I but our cyber essentials assessment says it's a required configuration!

 

To me it's an uneccesary complication.

[psydii]

Good Morning - this was all meant with the best intentions but has clearly gotten a few backs up.

 

@uccert You are not the first, nor will you be the last to fall into this trap. I am guilty myself.

 

I saw this thread on twitter recently, and it gave me pause for thought. https://twitter.com/KarimPalant/status/1405282612000686084

 

 

Sharing it here more as a reminder to me, but I hope others might find it useful also.

Edited June 18, 2021 by psydii

[Boredguy]

Neither can I but our cyber essentials assessment says it's a required configuration!

 

To me it's an uneccesary complication.

Thought that was a requirement if it was student personal devices and not school own devices, or certainly that was how I read the in and out of scope details. I took the easy route years ago and all personal devices are on a dedicated vLan with a completely different IP range and behind a NAT box that via a 2nd vlan then lets them out to our secondary ip range on the router (oh and the Wifi also isolates clients from each other just for more safety)

[Jimmer3568]

All the bickering aside, this is an interesting subject and one I'm thinking about. We have the following VLANS:

Production (Servers, Staff, Students, Printers, other bits and bobs)

Management (Switches, WAPs)

CCTV

VoIP

Wireless-Production

Wireless-Guest

 

We've just finished putting staff on MFA, so I think (and I'm no expert) that the biggest hole we have in our security currently is around the student accounts, which have pretty weak passwords. So to tackle this, I'm thinking of separating off the student desktops onto a Student VLAN, so an attack (either external or internal) would at least have another barrier. Yes, it'll be a pain, but it means I have done everything I can reasonably do to keep the school safe.

 

Interested in any feedback. Cheers.