Inherited Network, How do I change the setup to meet our needs

[JAB1a]

Hi All,

 

I have inherited a local school but I am having troubles working out the setup of the network.

 

There seems to be 2 different physical networks, each separated using different switches and a different port on the Huawei AR120 router. They are on different subnets too.

 

Port 1 on the Huawei Router is a curriculum network where the main server (Server 2016 STD) is that runs DHCP, DNS, Active directory. This is distributed via an unmanaged Cisco SR2024C switch around the school. Connected into the unmanaged Cisco switch is a managed Netgear GS728TP switch which runs POE to the Ruckus Cloud Wi-Fi AP’s.

 

The other physical network in the school is the VOIP network on a different subnet to the curriculum network, this is plugged into port 2 of the Huawei AR120 router. All the phones are using static IP’s

 

What I would like to happen…

Have both the physical networks connected so that I can utilise the network cables going into remote rooms around the school that are currently dedicated to the VOIP network, I want to use the cables for both networks.

 

For example, the kitchen uses a ‘Live kitchen’ system which is in a location that is not covered by the Wi-Fi network so that it needs to be connected via a network cable, but the kitchen only has one network cable routed into there and this is currently being used by the VOIP network. I can physically move that network cable and plug it into the curriculum network for the ‘Live kitchen’ system but then they won’t have a VOIP phone in there. So, what I want to do is use that one cable and have both the VOIP phone and ‘Live kitchen’ system running. (The VOIP phones have 2 network ports, in and out, so I can use that as a hub to connect to the ‘Live kitchen’ system)

 

Another example, there is a classroom where the teacher sits in a Wi-Fi dead spot, the network cable going to that room is being used for the VOIP phone, if I could use this cable then I could add a small standalone Wi-Fi AP in there and still use the VOIP phone.

 

Basically, I want to re-connect the school so that all network cables around the school are on the same physical network but be able to run the curriculum network and VOIP network side by side so that I can utilise every cable in the school rather than having the cables dedicated to either curriculum network or VOIP network exclusively.

 

I assume I would need to setup VLAN’s to handle this but I have no idea where to start there. Would I need to upgrade the current Cisco SR2024 switches to managed ones to sort this or can I use the equipment already in place to achieve what I want? Both networks use the same external DNS server from SWGFL.

 

The school has very little money so purchasing equipment might take a while if we need anything extra.

 

Please let me know if you need any more information or I have not given the right details.

 

Can anyone point me in the right direction on how I achieve this or know of a good guide I can follow.

 

Thank you for your time any help in advance

[ThatBoringBloke]

Depending on the size of the network could you not simply reset all the switches to factory default, and join the switches together. No need to VLAN if its only a small network (though others may say otherwise).

[mavhc]

Who set up the VoIP network, where's the VoIP server?

 

What's the config on the router?

 

Are the switches configured as VLANs, or just something on the router? Where do the phones get their settings from when they boot up?

[JAB1a]

Depending on the size of the network could you not simply reset all the switches to factory default, and join the switches together. No need to VLAN if its only a small network (though others may say otherwise).

 

Its a small network. the VOIP and curriculum networks are running on different subnets and use different gateways. I don't know anything about connecting two physically separate networks together that use different subnets and have it all play nicely. I can connect Port 1 and 2 of the huawei router into the same switch as both networks stop working then (In tried this).

 

Sorry I am a complete noob to this, it might be super simple to others but I just don't have the experience to sort this out.

[JAB1a]

Who set up the VoIP network - VOIP network is managed by Telephone-europe

where's the VoIP server? - they get their settings from the internet, no physical VOIP server on site here. Each phone has a static IP

 

What's the config on the router? Do you mean the Huawei router? I am not sure, I think SWGFL manage that router, I don't have any login details here for it. I just know Curric network is on Port 1 and VOIP is port 2.

 

Are the switches configured as VLANs - both networks use unmanaged switches so there are no settings to change here and no VLANs.

 

or just something on the router? - the networks are physically separate, the only device they both connect to is the Huawei Router via port 1 and 2 to connect to the outside world.

 

Where do the phones get their settings from when they boot up? - I assume they contact the Telephone-europe servers to get their settings, I have a website I can login to see any VOIP settings

 

Please let me know if you need more information

[Rob_D]

Do you know why it was set up like that to begin with? I'd be worried there might be a good reason for keeping them physically separate, that you only find out about when it breaks the network.

It's potentially more work, but have you considered just running extra cables in along the existing phone-network runs? (You can never have too many network points IMO)

 

If you do want to merge the networks, one thing to consider is if you can change the phone settings? (Our provider never gives us the admin passwords for our VoIP phones).

If you can change the phone settings, then I'd try putting it on DHCP and connecting it to your curriculum network and seeing what happens (Obviously make sure you can change it back if it doesn't work). If it works fine, then it's super easy. Just flatten the whole thing to a single network. At the least, it makes for a reasonable starting point - We have a larger network (100 IP phones, and 250 computers), which seem happy enough to share a VLAN.

[supportman]

Document and diagram everything at first. Work out what the network does and where it connects and what the reasons are for the split in the first place.

 

Merging networks is really easy but you need to check about things like vlans or subnets on the switches first.

[JAB1a]

Do you know why it was set up like that to begin with? I'd be worried there might be a good reason for keeping them physically separate, that you only find out about when it breaks the network.

It's potentially more work, but have you considered just running extra cables in along the existing phone-network runs? (You can never have too many network points IMO)

 

If you do want to merge the networks, one thing to consider is if you can change the phone settings? (Our provider never gives us the admin passwords for our VoIP phones).

If you can change the phone settings, then I'd try putting it on DHCP and connecting it to your curriculum network and seeing what happens (Obviously make sure you can change it back if it doesn't work). If it works fine, then it's super easy. Just flatten the whole thing to a single network. At the least, it makes for a reasonable starting point - We have a larger network (100 IP phones, and 250 computers), which seem happy enough to share a VLAN.

 

I am unaware of the original thinking behind the two separate networks. I can see no special configuration other than trying to keep the curriculum network completely separate (physically) from the VOIP network. All network cables go back to the same network cupboard which is where all the switches are and the Huawei Router. From the looks of it, the school used to have an IT suite and both unmanaged Cisco routers were connected to feed the whole school the curriculum network. Then at some point, the school has got rid of the IT suite and added a VOIP network and simply split the Cisco switches, used one for the VOIP network and the other for the curriculum network. They got rid of the suite so this feed up 10's of network cables as they no longer go to network points, they are just cut and left hanging. I guess they then requested another IP range and got that mapped to port 2 of the Huawei router as no other device in the school is on that IP range.

 

If I move a VOIP phone onto the curriculum network then it does not work as the phone system is using ports and IP's that are blocked. I believe the VOIP network is completely unfiltered as no proxy settings are in the phones.

 

I can route my own cable to the rooms but I am very bad at home DIY and the school is very tight on money to employ a company to add more network points. I had hopped I could just join both networks and then no extra money would need to be spent as the basic infrastructure is already in place, its just being used in a strange way lol.

 

Document and diagram everything at first. Work out what the network does and where it connects and what the reasons are for the split in the first place.

 

Merging networks is really easy but you need to check about things like vlans or subnets on the switches first.

 

The only item I do not know the setting of, is the Huawei router. All of the other switches in the school are on default settings (or are unmanaged) and no VLAN's setup etc. I just don't know what I need to do to combine the networks and still have the curriculum network and VOIP network play nicely together.

[LukeRowberry]

If you are unsure about making a change that could effect your entire network I'd be looking for outside support. outside support company or even a local school/MAT that has the expertise in house.

I get that they don't want to pay for support or even a new run but if that's the cost of having the kitchen system work then that's the cost. Either pay for it or don't have it.

[Rob_D]

As it stands, you have physically 2 separate networks and if you want to move a port from one network to the other you have to repatch it in the cabinet.

If you physically merge the networks, the basic way to set it up would be 2 VLANS (assuming all the switches support VLANS) to to keep the different subnets apart, and the easiest way to move a port between the VLANS would be to repatch it in the cabinet.

 

To get what you want, you'd need to configure your normal switch ports as Hybrid for both VLANS (this allows both VoIP and curriculum traffic on the same port, but would require the phones to be set to tag their traffic). Then you need to have Trunk ports for all your uplinks (so they carry both VLANS between the switches). And (probably) an access port for each VLAN going into the relevant router port.

Exactly how you do this is going to be dependent on your hardware, but hopefully this gives you start for googling.

[Michael]

Immediate thoughts that come to mind -

 

- Were you given a hand-over sheet of any kind?

- Before doing anything with phones, I'd engage the VOIP provider to better understand the configuration and likewise explain what you're trying to do. I'm somewhat perplexed why the phones all have static IPs for example.

- Likewise same/similar to the above, I'd engage the ISP what you're trying to do

 

For example it should be do-able to utilise the third port on the router, (communicating through the ISP) once you've gathered all the above info and then plan/consult the school when you're going to flatten the network. The priority immediately would be internet connectivity and phones, then everything else you can build on slowly.

 

Hopefully nothing else is configured statically, other than servers and printers. I'd definitely say this is still the investigative/planning stage.

[Davit2005]

It might of been setup that the VOIP is managed by an outside company and kept completely separate. It should not be necessary and using a different vlan for VOIP is perfectly acceptable but the company managing/supporting/implementing VOIP might of had a strong opinion.

[mavhc]

Take 1 phone, put it on the normal network, see if it works correctly, after testing move phones 1 by 1 by just moving the cable at the other end, if you have spare ports.

 

At some point you'll have about half on the main network, then just join the switches with a cable, remove the connection to the router, and see what happens.

[Koldov]

If I move a VOIP phone onto the curriculum network then it does not work as the phone system is using ports and IP's that are blocked. I believe the VOIP network is completely unfiltered as no proxy settings are in the phones.

 

So are you saying the VOIP phones network route to the internet via an unfiltered connection?

 

And the Curriculum network routes to a filter/firewall somewhere that blocks ports and IPs?

 

Therefore possibly the 'easiest' way to achieve this was on two separate networks via 2 separate switches?

[mavhc]

All the phones will have static IPs because no one set up a DHCP server for them.

 

Talk to the people controlling the router and the filtering, see what better solution you can work out.

 

Or just install FreePBX and run your own phones, much simpler

[PMFR]

1. Contact the ISP and ask them if they know how the two networks are configured - sometimes they are asked to route between subnets or physical networks. If so, it might be best to ask for that to be abandoned so that you can 'flatten' your network structure and have your VoIP handsets placed onto 'Port 1'. Once on Port 1, and so long as the VoIP provider agrees (see 2), your handsets should get their IP from your DHCP server and you will be able to utilise the 'remote' network cables etc.

2. I would contact the VoIP provider and ask them to enable DHCP for the handsets (this is normally very easy to do centrally).

3. You don't 'need' VLANS for your network - but it's sometimes nice to get the extra security and other features it would afford. Keep it simple right now, though: flatten things, get your VoIP handsets assigned IPs with DHCP, and make sure you can use the whole network and its infrastructure. Tweak and secure later. Unmanaged switches aren't great for this, and that's probably why they opted to segregate the LAN using the Huawei router. They will need to spend some money for a managed switch with the required features if they want to utilise VLANs at a future date. Like I said, for now, make things easy on yourself...

4. I would do this over the coming half term (or better, the summer)!

 

Good luck!!!

[Davit2005]

Some school networks were setup with different admin and curriculum physical switches but this is not necessary INMO, wastes money and is overkill.

 

vLANS (configured in best practice), subnets (and if need be ACLs) along with regular patching and client protection at the most should be enough in a school environment.

 

It was setup like that at my first school I worked at.

Edited May 10, 2022 by Davit2005