Device IP Allocation

[barryfl]

Hey Everyone,

 

Just thought I would try and get some input on a problem i have at the moment:

 

(Most) of our printers and older switches (Ones that I didn't install) are currently on an IP range of 192.168.x.xxx ranging from 100 to 300 and a subnet of 255.255.252.0

 

Now I don't think this is correct. Firstly that subnet is not valid for that IP address range and I have also noticed some very strange things starting to happen now that I have turned STP (Kids know that broadcast storms break networks without it turned on now).

 

Firstly our STP new managed switches are on our 'normal' IP range of

172.xx.xx.xxx and a subnet of 255.255.252.0. I have set allocations for these in DHCP and from there I can see what devices has what IP. I have also noticed that the devices are quicker than he ones on the private subnet both in terms of say printing or loading up web interfaces in IE for management.

 

I have run ethereal to see what the switches are doing in the way STP path resolution and there seems to be a couple of seconds if not more in terms of latency in resolution of private devices. Sometimes i also see complete failure in communication with the device VIA web interface.

 

To my way of seeing it we don't actually have anywhere to see what device has what IP address. I have tried to explain that putting them on the same IP Address range and subnet will boost performance of these devices but I don't seem to be getting anywhere except 'It was installed by RM that way'

 

Anyone got any thoughts/How you do it (All comments appreciated, Even if you are CC3 OR Vanilla) on this as I don't want to keep pushing it if I am not accurate, After all the people I am challenging on this could be right, And knowing my luck me be wrong.

 

Barry

[ChrisH]

How are these devices routing between each range? They arent using another protocol like NETBEUI as from what you have said I dont see how everything is talking to each other.

 

We have our county wan IP range assigned to us on a 10.x.x.x/24 most of us nat this and use a 192.168.x.x range I personally use 192.168.0.0/24 . All server switches APs etc are in the 192.168.0.x range and all the clients are in the 192.168.1.x range . I also split the 192.168.0.x range up so the IP is 192.168.0.101-110 I know its a device in cabinet 1 etc.

[barryfl]

Erm, Not sure i have fully explained myself. I have included a diagram to try and help explain.

 

The traffic is just TCP/IP traffic, The switches are working out the route to take to the device. I can only call up the interfaces for these devices via the server with the second IP address setup on the NIC as i hope the diagram shows. The users can print because they print to the spool on the server which can communicate with the print device.

 

Does this help explain?

 

Barry

[ChrisH]

Ah right so they are going through the dual honed server. That makes sense how but not why The only reason I can think of is to force users to use the server rather than print direct which is a bit much.

[E1uSiV3]

Is it possible your firewall/proxy box is acting as a router for the 192.168.3.0/22 traffic, routing it back onto the local network?

 

This would cause a big overhead on the router/firewall/proxy box and would mean all traffic would be going across the switch it is connected to.

 

I do have a couple of questions.

 

Firstly, how come you are using a 22bit subnet mask? do you really need 1022 IPs in a single subnet?

 

Secondly, on your diagram, you have a the proxy and a workstation with the same IP, is this a typo?

 

You really need to move the "old" equipment across to the new range, running it like this is not good, and it is my belief the only reason it is working is because the proxy/firewall/router is performing routing back onto your network.

[steve]

If you tracert the printer from the client, whats the route?

[Ric_]

It looks to me that you have a switch plugged into your Internet router and any client on the 172.x.x.x range is going straight to the net rather than through your firewall/proxy.

 

What you should do is re-configure everything so that it is in the range 192.168.x.x and ensure that the only device connected to the router is the second NIC in the firewall.

 

Since you don't really know what is going on with the addresses of the managed switches anyway, it would be a good idea to reset them and document the new address.

[PiqueABoo]

It's a perfectly reasonable scenario, I'd have added new printers & switches to the 192.168 range. To "see" them I'd add them into DNS same way I'd add any device with any static IP that doesn't do DDNS.

 

STP is supposed to work at layer-2 (MAC Address). IP is layer-3 and should be irrelevent to STP.

 

I can't quite decode what you mean by "latency in resolution".. is that figuring out what IP addresses go with the MACs? Or is it also trying to get DNS names?

 

Whatever, I suspect the 'performance' issue only affects Ethereal.

[barryfl]

OK. Sorry i haven't posted on this recently (FR Died Monday and have been busy with RM trying to get the thing fixed)

 

I don't think i have explained myself fully enough here. Firstly i should state that yes that is a typo in my diagram with the client IP and the proxy IP (I was very tired)

 

Now let me try and give this another go.

 

All of our Printers are on a 192.168.1.xxx (xxx being a number between 100 and 200) the subnet mask for this is 255.255.252.0. Now That subnet mask isn't valid according to what i know and also from double checking with the boson IPSubnetter tool it says that subnet mask is a class B mask (Also says supernetting)

 

Our network IP address range comes from the LEA. We have no control over this. As without it we can't use the grid (The internet).

 

The server has dual IP address configured on its NIC so that we can use it to manage the printers VIA web interface (You can't do this on any other machine except the server because the address isn't in the range of any of the clients hence the dual IP config on the server)

 

Now surely it makes more sense to put our printers on our LEA assigned IP address range and set allocations in DHCP for them?

 

That way we have a central point of seeing what device has which IP address.

 

I have intermittent problems communicating via web interface with devices on the 192 range, I think this is a resolution problem (partly because the subnet is wrong)

 

I don't have problems with devices that are on the LEA assigned 172.19.xx.xxx range.

 

People can print and from that point of view its all good, Its just not being able to manage it VIA web browser (Almost like its timing out because the switch can't work out the route to the device) and that i have no central point of seeing what device has what IP (Because there are no reservations in DHCP)

 

Thanks to all that are posting, I hope that makes a bit more sense. I am trying my best to articulate this one but its hard.

 

Barry

[ChrisH]

Im guessing here that you have trouble administering from clients but if you try from the server it's ok?..........

[barryfl]

Im guessing here that you have trouble administering from clients but if you try from the server it's ok?..........

 

Spot On

[ChrisH]

Thats because the server is the only one that sees that range. The server is not acting as a router it just has 2 IPs. The switch cannot go from a 172.x range to a 192.x range thats a routers job.

If you tried to print directly to the print device from a client that would fail as well its been set up so all printing has to go through the server as there is no other path to it.

[barryfl]

Yup, This has been exactly my point, So i clearly have a valid point when i say that moving it to the public range is the most technically valid thing to do. Remember im looking to prove my point to management because they believe it has been done this way by RM on purpose and that it should stay this way.

 

My point is i don't have any way of:

 

A) Managing the devices from anything but the server

B) See what device has what IP address as its not reserved anywhere / documented

C) The subnet mask for that Class C address is not valid which is probs why the web interface is a bit hit and miss from the server i try to configure it on

 

Im looking for people to back me up here really. Am i making more sense?

 

Cheers,

 

Barry

[ChrisH]

Correct me if im wrong but the 172.x range is your IP range assigned to your school to connect you to your grid?

 

Ps your points are very valid

[barryfl]

Thanks Chris, It is indeed

 

Barry

[ChrisH]

Right so yes your choices are to get everything running how you need it you:

1. Change everything to the 172.x

or

 

2. If you want more flexible ip configuration and a little more local protection from things lurking around on your grid then use a 192.x range for all your local devices and have a dual honed proxy natting your 192.x range to your grid 172.x range.

 

Number 2 is the way I have it set up as do a few others I know of. Other keep their county assigned range as some rely on getting remote support from their LEA etc..

 

Either way you need to change the current setup.

[barryfl]

Great, Thanks for that. Security was a valid argument that i can understand but figured that the router/firewall should have been configured by the LEA to make this schools seeing other schools kit a non-issue. Further, I always password protect my devices when setting them up (And document the config)

 

How do you keep track of what printer has which IP? Manually? Or have you setup something in DHCP (Like a scope with reservations for the 192.x.x range)?

 

Do you agree that 255.255.252.0 is an invalid subnet mask for a class C address therefore I would have to change that aspect?

 

Regards,

 

Barry

[GrumbleDook]

wow ... what a pants setup ... please don't ake any offence at that comment, but there is one thing missing here in a major way.

 

What on earth is doing your routing?

 

You should have at least one device available to route traffic between the subnets. You have one to route between 172.19.x.x as the proxy is also your default gateway ... so it says "any traffic note for this network should come through". Nothig is saying "for 192.168.3.x please line up here and a club 18-30 rep will be along shortly".

 

Your switch is a layer 3 switch and can be set up to do your routing for you (up to 16 static IP routes IIRC) but that still does not work with the topology you have.

 

As for the subnet mask ... it is possible to use it ... to make it a /22 address range, neither class C or B actually, and I am glad they did away with allocationg to classes (a class C range is typically /24, 255.255.255.0) and with the 2650 it is possible to have routing tables that will allow for the broadcast across all the 1022 hosts ... but I would not rely on it.

 

http://www.subnetonline.com/subcalc/subnet8.html for a nice calculator for subnetting.

 

I honestly cannot see any reason to be using this range ... none at all.

 

I would get the printers onto the standard range and disable the second NIC in the FR.

[ChrisH]

I have DHCP reservations for my devices.

According to the IP calculator that is a strange range as it reports these ranges

 

# ID Range Broadcast

0 192.168.1.0 192.168.1.1 - 192.168.1.62 192.168.1.63

1 192.168.1.64 192.168.1.65 - 192.168.1.126 192.168.1.127

2 192.168.1.128 192.168.1.129 - 192.168.1.190 192.168.1.191

3 192.168.1.192 192.168.1.193 - 192.168.1.254 192.168.1.255

 

Dont think too much about class specific subnet ranges though as they seem to be ignored a lot now though. Anyway bedtime it's friday! 8O

[barryfl]

wow ... what a pants setup ...

 

lol you don't have to tell me that, I have been saying this since....well....forever.

 

Using that subnet mask isn't exactly standard. Even the link to that subnet calc reports that 'Note: 192.168.3.100 is a class C IP address and is normally used with a subnet mask of type 255.255.255.x'

 

 

I have DHCP reservations for my devices.

According to the IP calculator that is a strange range as it reports these ranges

 

# ID Range Broadcast

0 192.168.1.0 192.168.1.1 - 192.168.1.62 192.168.1.63

1 192.168.1.64 192.168.1.65 - 192.168.1.126 192.168.1.127

2 192.168.1.128 192.168.1.129 - 192.168.1.190 192.168.1.191

3 192.168.1.192 192.168.1.193 - 192.168.1.254 192.168.1.255

 

Dont think too much about class specific subnet ranges though as they seem to be ignored a lot now though

 

Im glad it chucks stranges things out at you too. I have always been taught to follow standards. Otherwise things slip.

 

Thanks for your input at this stupid time of night. I need my sleep too

 

Night All

 

Barry

[PiqueABoo]

It is not a pants setup (or at least it wasn't). It's a perfectly adequate setup designed to raise the bar a little to prevent workstations on your LAN from messing with resources they don't need to access.

 

Comments about routing are red herrings.

 

Supernetting and subnetting has been around and perfectly valid for a long time i.e. 255.255.252.* is perfectly fine here, regardless of what some calculator says. Strictly classful networking went by the way ages ago in order to alleviate the alleged "world running out of IP addresses" problem.

 

Again DHCP and DDNS is mostly for random workstations, whereas everything else usually requires a static address. If you do have a devices like that.. and you always do.. it's a good idea to manually add DNS entries for them. I wouldn't bother with DHCP reservations (but the static address must be in an excluded-for-lease range).

 

If it were my network I'd likely change the new stuff you put in from 172 to 192 addresses to be consistent with the others. If I did have to talk to my switches and printers from somewhere besides the server it would likely only be one specific admin machine (probably a troubleshooting laptop) and I would give that static address in both the 172 and 192 ranges. Regardless I can always remote desktop to the server.

[Ric_]

It does appear to be set up so that only the dual-homed machines can administer and contact the printers, etc. - a little paranoid and it does indeed add a layer of complexity that you could do without.

 

I use the IP range 192.16.0.0/22 and use NAT to get out onto the RBC WAN. This works perfectly well.

 

I also use reservations to assign the IP addresses to my printers - this means I can easily check which device has which IP and I can change them as needed.

[PiqueABoo]

Well I think we'll just have to agree to disagree then...

 

To me it's useful to have the logical separation between a) the Windows domain boxes, and b) all those other devices with their various (and variously secure) services that users have no need to access. Maybe I've got a warped mind, but I think a network "overlay" like that is a simple concept and trivial to configure/maintain.. just a minute of additional work when you add servers to handle print queues or setup a network admin workstation.

 

And I don't think it's paranoid, but I'm aware of various exploits and one school in particilar that spent a lot of time tearing their hair out over some printer mischief this would have stopped dead. A better p-word word is prudent... it doesn't cost much and might save you a lot of hassle. It also conserves real IP addresses (assuming you use those for your workstations).

[barryfl]

Its very interesting, Different people have very different ways of doing this. For example, A college just down the road do it the public way so they can administer from anywhere. I also think industry sets these sorts of things up in the same way.

 

I prefer the public way because that’s the way I was taught. My NM is set in her way, and I am sure she as her reasons for it so I am not going to challenge anymore.

 

I guess when I am a NM someday I can make these types of decisions my way.

 

Thanks to all that posted.

 

Barry

[GrumbleDook]

@piqueaboo: But was is the point in dual-honing a server so that only the server can talk to certain devices? Security? maybe ... but it is still regarded as poor practice to do it this way nowadays ... even NSA security guidelines point to using VLANs and ACLs on switch ports to do this control. This also improves performance of switches, which is becoming more important when having to allow for QoS.

 

I stand by the above configuration being pants ... if you don't accept my reasoning, think about the amount of confusion it seems to have caused, including extra work for configuration. Surely having the single scope on DHCP which allows for reservations being made via MAC address so a printer can be dropped in and configured with ease, saving time and effort.

 

As for routing being a red herring ... every subnet / range should have a default gateway; this does not seem to be the case. So you end up having every switch doing the routing, relying on their own table or on broadcasts. Again ... regarded as poor practice and in larger neworks, especially those using VoIP, VLANs, QoS ...

 

I have to admit to trying to make things as simple as possible really ...

 

Then again ... I refer all honourable members to RFC 1925 (the twleve truths of networking) ... in particular rule 12