Settle a bet - VLAN and DHCP scopes

[Warwick_Tech]

I was having a discussion with a colleague about VLANS and we came to a contested point -

 

He was taught by his professor that any and all VLANS must have a dedicated DHCP scope, ie regular traffic is (0) on 192.168..... VLAN (1) has to be on a different scope, ie (10.18.....)

 

Now, I was under the impression you can seperate VLAN traffic from other nodes, but still retain the same DHCP scope (Ie they all have a 192 address)

 

This allows you to isolate devices (CCTV, Wireless, Admin, Students etc.) without having to build a new DHCP everytime, and it allows cross communication for servers - Otherwise how would you share for example a file server between two VLANS, while keeping the nodes from communicating with each other...

 

Maybe I'm thinking of firewalls.....

[Jcx500]

I've always gave dedicated scopes (i was taught this also) , i've done split scopes as well so 10.10.10.126/25 and 10.10.10.254/25 Edited February 3, 2022 by Jcx500

[Davit2005]

Not sure I understand.

 

vlans done right can improve security, improve reliability/stability and reduce the broadcast domain but devices in different vlans can only communicate to each other via a router so I'm not sure how you can have the same scope/subnet on different vlans anyway, the router/firewall/l3 switch will normally complain of overlapping addresses.

 

Layer 3 switches by default normally allow cross vlan traffic but firewalls will normally be the opposite and only allow what you want and deny by default between zones/interfaces.

 

ACLs can be used on a layer 3 switch or as you say use a firewall.

 

But yes I have different scopes per vlan. It is real easy.

Edited February 3, 2022 by Davit2005

[Oaktech]

Oh Pandora, what a box you have opened...

 

You can, but you are in the realms of needing your DHCP server network card to be untagged in one vlan and tagged in eleventy billion other vlans, or doing your DHCP on a router/utm/firewall. You need all your devices to all be able to tag their traffic, or you need to do a metric cr*p-tonne of switch config and massively limiting the flexibility of your switch estate.

 

Way easier to do it on different scopes with different DHCP servers in each VLAN (again, something you can do on a good router or UTM) and just route between them at L3 either on a core switch or a router. You need to also consider what needs to see what. You can ACL your VLANS such that ingress/egress to a file server IP is allowed from multiple VLANS but not for other devices

Edited February 3, 2022 by Oaktech

[Warwick_Tech]

Ok, so clarification with crappy diagram time!

 

so PC A is untagged and can access everything, PC B is VLAN tagged 10 and can only access DC and the Fileserver (PC A and B cannot communicate)

Edited February 3, 2022 by Warwick_Tech

[Warwick_Tech]

Oh Pandora, what a box you have opened...

 

You can, but you are in the realms of needing your DHCP server network card to be untagged in one vlan and tagged in eleventy billion other vlans, or doing your DHCP on a router/utm/firewall. You need all your devices to all be able to tag their traffic, or you need to do a metric cr*p-tonne of switch config and massively limiting the flexibility of your switch estate.

 

Way easier to do it on different scopes with different DHCP servers in each VLAN (again, something you can do on a good router or UTM) and just route between them at L3 either on a core switch or a router. You need to also consider what needs to see what. You can ACL your VLANS such that ingress/egress to a file server IP is allowed from multiple VLANS but not for other devices

 

That's what I thought - If I take a physical new cable to a new port on the DHCP server, that becomes tagged and allows communication... but then you're adding pysical cables to a virtual solution, why can't you just tell a port to accept all traffic regardless of VLAN ID....

 

Edit, and then technically wouldn't it be on the wrong IP address for the DHCP server so fail anyway :S

[mavhc]

Yep, vlans are layer 2, IPs are layer 3

 

Of course your dhcp server has to have 2 network interfaces, with 2 IPs, and to be listening on both

 

The reason to have different scopes is so you can tell what the hell is happening, look at the IP, know which vlan it's on, but it's SHOULD rather than MUST

[Boredguy]

You don't have to have a DHCP scope on a vLan, it entirely depends what you are wanting it for.

 

We have several vLans configured, 2 for BYoD (1 with SSL interception, 1 without) and I've got the NAT box on each of those vLans doing DHCP for it with a different range.

I've got a vLAN for CCTV that has no DHCP server attached as everything has static IP's.

 

When it comes to switches, you have Tagging and pvids to take into account.

If you set a port up with a pvid of 40, but it's "Untagged" (ie not Trunk for multiple vLans) then only traffic on that vLan id can access is.

Your Uplink ports would be "Tagged" or "Trunked" with the different vLan id's which can be different the pvid (which is the default vlan for that port)... and of course the terms can change depending on brands

[Warwick_Tech]

so It seems Synology boxes support this - but only through the CLI, not GUI

 

https://techoverflow.net/2021/08/29/how-to-add-multiple-vlans-over-single-network-interface-to-synology-dsm/

https://baihuqian.github.io/2021-01-16-secure-home-network-how-to-connect-synology-nas-to-multiple-vlans/

 

But they make no mention of the same DHCP range - and I can't seem to get it to communicate with the DC as again, there's only an option for one VLAN ID per physical port

 

https://www.virtualizationhowto.com/2021/05/windows-server-dhcp-vlan-configuration-detailed-guide/

[psydii]

You can, but you have you stopped and considered whether you should?

 

 

Your aggregation switch has an IP in each vlan that is configured to be the gateway/router address for all clients in that vlan. The aggregation switch has routing enabled. The router knows how to route packets to the appropriate subnet, not where the individual device is on that subnet, so into which vlan is it going to send it? It requires blurring of the logic between Layer 2 and Layer 3.

 

You can of course legitimately have multiple subnets per vlan. But a subnet spanning multiple vlans is inviting chaos into what should be a relatively deterministic system.

Edited February 3, 2022 by psydii

[Boredguy]

It also depends if your Switch supports layer 3 for intervlan routing, or if it's just a layer 2

 

All our switches are Layer 2, so even if I wanted to split the Printers from the Workstations so only the Servers could talk directly to the Printers, it wouldn't work unless I had a layer 3 switch to route the traffic across, or I setup a network card on the server on the same vLan as the printers.

 

It can be a complex task and entirely depends on what your system is designed for.

[mavhc]

It requires blurring of the logic between Layer 1 and Layer 2.

 

Did you mean layer 2 and 3?

 

Interestingly the new CS GCSE doesn't use the 7 layer model, as neither do we. 4 layer TCP/IP model instead, which ignores layer 1.

[psydii]

Did you mean layer 2 and 3?

 

That's what I said. *cough*

[FN-GM]

That's what I thought - If I take a physical new cable to a new port on the DHCP server, that becomes tagged and allows communication... but then you're adding pysical cables to a virtual solution, why can't you just tell a port to accept all traffic regardless of VLAN ID....

 

Edit, and then technically wouldn't it be on the wrong IP address for the DHCP server so fail anyway :S

 

We have a DHCP server with nearly 100 scopes and 1 NIC. You use IP Helper-Addresses on your Layer 3 switch.

 

It would be physically impossible to have a NIC in each VLAN as the server is hosted in a data centre thousands of KM away from the site.

[RobD]

We have a DHCP server with nearly 100 scopes and 1 NIC. You use IP Helper-Addresses on your Layer 3 switch.

 

It would be physically impossible to have a NIC in each VLAN as the server is hosted in a data centre thousands of KM away from the site.

 

exactly the same as us.

[TechMonkey]

As others have commented, technically you can, but why would you? From ease of troubleshooting, to just ease of use and managing. Seeing a xx.xx.10.xx IP range and know that is a particular area or type of device, or how ever you organise, is such a benefit, even over flat networks I feel.

[jtotheb]

Ok, so clarification with crappy diagram time!

[ATTACH=CONFIG]64503[/ATTACH]

 

so PC A is untagged and can access everything, PC B is VLAN tagged 10 and can only access DC and the Fileserver (PC A and B cannot communicate)

 

You would not do this with standard VLANs. You can isolate clients in the same subnet using Private VLANs, but it is not something you would normally use in a LAN. It's more commonly used in service provider environments to segregate customer equipment from each other when they all reside in the service provider's subnet.