What private IP range do you use on your LAN switches

[Jaan]

We'll be update our switches so and want to take the opportunity to remove the switches from the 192.168.x.x range. Don't like the idea of our switches sitting on the most popular domestic IP range.

 

Do you guys have your switches on the same IP range as you clients or a different range? If so what range would you recommend?

 

Just thinking out loud.

 

cheers all

[Chuckster]

Switches, servers, workstations, printers etc are all on difference subnet ranges.

 

For example:

 

10.0.1.0/24 switches

10.0.2.0/24 servers

10.0.3.0/23 workstations

etc

 

With ACLs configured to ensure VLANS are able to communicate amongst one another whilst others are blocked for internal access but go straight out to the internet, e.g. BYOD schemes.

[FN-GM]

Every network I have managed switches have always had their own dedicated VLAN and IP Range.

[Jcx500]

Usually do subnets/vlans like this

 

10.10.10.xx - switch / wireless management

 

10.10.15.xx - SAN Networks

 

10.10.20.xx -servers

 

And so on.

 

Usually change the second octect for different sites etc

[msi_school]

I like to use 10.>100.x.x or 172.16.x.x because they are less popular so cause less issues with VPNs after once having a collision with our MIS provider. Obviously you need to do your VLAN and Subnet design but I like to have a management VLAN which has all the active kit on it and is strictly ACLed

[mavhc]

Which switch IP? The one for each vlan that requires l3 routing, or the management IP?

 

Doesn't matter for management as they're never one the same vlan as the rest of the devices, right?

[dmj]

I do a single management vlan for all servers, switches, san devices etc. No point in having separate management network for each type of device.

 

Not quite sure what the question is though, presumably you can't just plug in a laptop on this network without authentication....

[TechMonkey]

Previous place used 10.10.xx.yy where xx was a classification (10 for management or switches, 20 for servers, etc) and yy was the dished out IP.

 

Here we are going to go to 10.zz.xx.yy where zz is the site and the rest is the same as above.

[msi_school]

Which switch IP? The one for each vlan that requires l3 routing, or the management IP?

 

Doesn't matter for management as they're never one the same vlan as the rest of the devices, right?

 

The management port is connected to a management VLAN which is kept separate from the general users because their is no reason form them to connect to it.

[Jaan]

yes this,

 

Our mgr ports are set to 192.168.x.x on the management vlan1.

 

our l3 switch ips and Vlans are specific to the devices. Client/printers/wifi/server etc

 

We use 10.15.20.0/22. All our mgr switches are currently on 192.168.x.x.

 

just feel weird using 192.168.x.x on the switches, but i guess its not a issue as long as it's all vlan'd.

 

I struggle to get my question across sometimes.

[Jaan]

presumably you can't just plug in a laptop on this network without authentication....

 

Genuine question, what do you mean by that? If i plug a untrusted non domain laptop into the network, i get an IP from the DHCP. but i'm blocked from accessing any network resources. It seems to be blackholed, should i not even get an ip? should i be getting a 169.x.x.x instead.

 

I know mac address port security was being talked about in the past.

 

I'm not great with VLAN its always been something i'm struggled with.

 

cheers

[slugshead]

192.168.xx.yy for switches and APs here on a /22

 

everything else has it's own, 172.xx.yy.zz - xx denotes vlan

[Davit2005]

Different vlan and IP range. Also switches can only be managed from specific IP addresses. Physical security is always a factor too. Disable core switch ports that are not used and always tag client traffic on uplinks.

 

My dream would be for anyone to be able to plug a device in a wired port and it gets access based on the device/user. MAC address restrictions can still be got round by spoofing. And if you only provide DHCP via reservations someone can always guess an available IP.

Edited October 5, 2022 by Davit2005

[dmj]

Genuine question, what do you mean by that? If i plug a untrusted non domain laptop into the network, i get an IP from the DHCP. but i'm blocked from accessing any network resources. It seems to be blackholed, should i not even get an ip? should i be getting a 169.x.x.x instead.

 

I know mac address port security was being talked about in the past.

 

I'm not great with VLAN its always been something i'm struggled with.

 

cheers

 

Sensitive networks should have 802.1x on them so you can't communicate on them at all without authorisation. Typically you would give IT Staff authorisation to access the management ports on the management vlan, give school staff access to the 'admin' network etc.