VLANs - Preferred Configuration

[EeboBebo]

We have our VLANs setup per building and as a consequence we have over 60 VLANs with 130 Switches across the campus. Is it better to setup the VLANs for device types rather than per building? One issue we get is that when devices move buildings, they have to get a new DHCP address which in itself causes issues with client connectivity.

 

Thanks

[ColonelPanic]

Morning,

60 VLANS seems like far too many IMO - unless you need to segregate network traffic in each building.

We use 10 VLANS on our site

• Windows Clients
  
• Mac/iPad Clients
  
• VOIP
  
• Wireless management (access to AP configs)
  
• Guest Wifi
  
• BYOD Wifi
  
• CCTV/Security
  
• Switch Management
  
• Server iLO
  
• Hyper-V/VM management
  

 

We probably have too many to be honest, but having them on separate IP ranges helps with web filtering, and access control between networks.

[Davit2005]

I'd defo go vlan per use/device type as @ColonelPanic mentions. I don't thing 60 vlans is a lot though. With vlans you are basically reducing the size of the broadcast domain as well as introducing a level of security but bear in mind vlans themselves introduce little security you really want ACLs etc. between less secure devices and more secure services/management. Also don't untagg client traffic on any uplinks (prevents vlan hopping)

 

If you do have a network loop it will be isolated to a specific area and easier to troubleshoot, been down that road a few times.

Edited June 6, 2023 by Davit2005

[Jcx500]

We have the following

 

Wired Clients

 

Wireless Clients

 

Guest Network

 

Staff SSID Vlan

 

Servers Vlan

 

VOIP

 

WAN-Interconnects

 

Management , switches / vsphere / ilo

 

Isolated Backup VLAN

[Oaktech]

At my last secondary we only split off by building for 2 blocks - one block was an ALP and they had all manner of behaviour issues which frequently caused network loops, the other had a high proportion of Macs.

 

Otherwise it was split off:

 

Wireless

Guest Wireless

Printers

Macs

Management

Voip

WAN link interconnect

Digital Signage

Everything else.

 

My current primaries the only VLans are

 

Printers,

Voip,

Management

Everything else

[mavhc]

Shouldn't you be fixing network loops with spanning tree?

 

Per building vlan to reduce intra-building traffic?

 

First decide why you want vlans in the first place. Then measure your assumptions, what percentage of your traffic is broadcast? Vlans aren't the only way to solve that, can also just not put things on the same LAN and use a router.

[Chris_Cook]

We are currently setup as a combination - each building for user-facing wired devices, and then separate site-wide vlans for each type of wifi, BMS, CCTV, AP management etc.

 

With less devices being plugged in and moving to Wifi, I'd probably base it more on the type of device and level of security it needs. Obviously Vlans alone don't give the security, but its a start for firewalling things off.

 

One of the big reasons for us was to reduce the risk of network loops taking down the whole network. These days with more up to date switches, STP handles this better.

[Oaktech]

Shouldn't you be fixing network loops with spanning tree?

 

Bold of you to assume the switches were new enough to have STP.

[Julian]

My question is how many devices are on each vlan?

 

10 devices, vlan is to small

1000 devices, vlan is rather large.

 

So 60 vlans for a large site may well be correct.

 

I also agree that some vlans are needed for a specfic purpose, rather than location, examples include telephones, CCTV, WiFi backbone.

[FN-GM]

The best network design is not have broadcast on your uplinks. So your setup of VLANS not spanning multiple buildings is good. In practise it can be a pain and I very rarely see it in use. I generally only see it localised to each site.

[TechMonkey]

Currently using a VLAN per category of device, clumped by location. At a previous place we also did PCs by building, but everything else was across the site.

 

As Mavhc says, base it on what you are trying to prevent, achieve or reduce. If 'noisy' Macs or printers are an issue, VLAN them. If unnecessary inter-building traffic is an issue then VLAN the buildings.

 

Whether 60 VLANs is lots depends on size of the site/estate and how it is divided up.

[mavhc]

Or just disable the features that cause broadcast packets if you don't need them.

 

Running wireshark with a filter of eth.dst.ig == 1 (IG = Individual or Group) shows 410 packets in 1 minute, mostly down to misconfiguration of a VM, and an agent, should fix those.

 

Is your result a big number? For me: 5000 bits per second, not even 0.1% of the slowest 100Mbps link