Creating Vlans / IP Ranges on HDCP

[ITJS2015]

Good Morning

 

I am wondering if anyone could help me to get familiar with how to setup multiple vlans. Currently we have a 1000 IP addresses and we have a flat network with our LA using fortinet filtering.

 

Basically I want the following to be done -

Staff Desktops

Student Desktops

Staff Wifi

Student Wifi

Tvs

Student Mobile devices

Staff Mobile Devices

Printers

CCTV

Door Access

WIFI APS - Not sure if that is needed ?

 

To be honest i am not sure if i would need that many Vlans creating but this is just an example . So tell me if i am wrong would we need 2 iP addresses for Broadcasting and a gateway for each vlan ?

 

If that was correct could someone give me an example table going off the following 192.168.1.1 -192.168.4.254 , I know its just over 100 IPs but if someone could show me and example that would be appropriated.

[RobD]

If you take a 192.168.0.0/21 and break that down to /24 you get this:

 

Subnet address Range of addresses Useable IPs

 

192.168.0.0/24 192.168.0.0 - 192.168.0.255 192.168.0.1 - 192.168.0.254

192.168.1.0/24 192.168.1.0 - 192.168.1.255 192.168.1.1 - 192.168.1.254

192.168.2.0/24 192.168.2.0 - 192.168.2.255 192.168.2.1 - 192.168.2.254

192.168.3.0/24 192.168.3.0 - 192.168.3.255 192.168.3.1 - 192.168.3.254

192.168.4.0/24 192.168.4.0 - 192.168.4.255 192.168.4.1 - 192.168.4.254

192.168.5.0/24 192.168.5.0 - 192.168.5.255 192.168.5.1 - 192.168.5.254

192.168.6.0/24 192.168.6.0 - 192.168.6.255 192.168.6.1 - 192.168.6.254

192.168.7.0/24 192.168.7.0 - 192.168.7.255 192.168.7.1 - 192.168.7.254

 

Used this to generate.

 

So you could use 192.168.*.1 as the GW for each vlan. Set these up on the switches and then make matching DHCP scopes.

Edited June 15, 2023 by RobD

[ITJS2015]

Thank you for this link its really useful. My question back to you is what is the /21 and the / 24 mean ?

 

Is this table above what you would go off what iv provided above ?

 

Your table looks like there more thank 1000s IPs

[Aprice]

Thank you for this link its really useful. My question back to you is what is the /21 and the / 24 mean ?

 

Is this table above what you would go off what iv provided above ?

 

Your table looks like there more thank 1000s IPs

If you were to right out the subnet mask in binary form and count up the 1s then you get that value. just easier than writing 255.255.255.0 a million times - that mask would be /24

e.g.

255.

11111111.

I would suggest you need a larger allocation of IPs if you're going to do this. with 1000 addresses you could only fit 3 /24 subnets (VLANS in) ok some may not need to be that big

 

 

Happy to send you our one of our VLAN / Subnet spreadsheets which shows how we do our designs, if you drop me a DM.

Edited June 15, 2023 by Aprice

[Miscbrah]

Not to ask awkward things (and this totally isn't what you're asking of course) but are you married to that range? Could you potentially move to e.g. 10.x.x.x?

 

Is your core switch in place and capable (layer 3) and all the other switching around the place set up to do VLANs?

 

I'd say also looking at the objectives that CCTV and door access (if it's something like Paxton for example) can live on their own static IPs well out of your regular device ranges too.

 

...if any of that sounds like gobbledygook let me know that too!

[Davit2005]

/21 and /24 are CIDR notation. It is basically bits used for the network part of the address.

 

Below is a /24 if you look at the 1's and count them from the left that is how many bits are allocated to the network part of the IP address aka Subnet mask

11111111.11111111.11111111.00000000

Edited June 15, 2023 by Davit2005

[ITJS2015]

Thats what i though about needing more IPs and doesnt look enough to be honest.

 

Iv worked off /22 and its given me this off 1000 IPs. I do not like have 4 vlans for student laptops as we have nearly 400 when i think it should be at least 2.

 

what do you think to this. Will it work ? i dont think its the best setup for 1000 IPs

 

192.168.0.0/25 192.168.0.0 - 192.168.0.127 192.168.0.1 - 192.168.0.126 126 192.168.0.128/25 192.168.0.128 - 192.168.0.255 192.168.0.129 - 192.168.0.254 126 192.168.1.0/25 192.168.1.0 - 192.168.1.127 192.168.1.1 - 192.168.1.126 126 192.168.1.128/25 192.168.1.128 - 192.168.1.255 192.168.1.129 - 192.168.1.254 126 192.168.2.0/25 192.168.2.0 - 192.168.2.127 192.168.2.1 - 192.168.2.126 126 192.168.2.128/25 192.168.2.128 - 192.168.2.255 192.168.2.129 - 192.168.2.254 126 192.168.3.0/25 192.168.3.0 - 192.168.3.127 192.168.3.1 - 192.168.3.126 126 192.168.3.128/25 192.168.3.128 - 192.168.3.255 192.168.3.129 - 192.168.3.254 126

[Davit2005]

Check out an online subnet mask calculator that will give you a good idea.

 

Personally I'd agree not to use a class C to work with a /21 . I don't think it is good practice and might well lead to issues with routing. It might be fine for a home network where you are behind one router that is doing your NAT but some LA networks are not done like that.

Edited June 15, 2023 by Davit2005

[FN-GM]

Why are you separating staff and student devices? You have a limited space to work with an merging them will add some flexibility.

[DGardiner]

Thats what i though about needing more IPs and doesnt look enough to be honest.

 

Iv worked off /22 and its given me this off 1000 IPs. I do not like have 4 vlans for student laptops as we have nearly 400 when i think it should be at least 2.

 

what do you think to this. Will it work ? i dont think its the best setup for 1000 IPs

 

192.168.0.0/25 192.168.0.0 - 192.168.0.127 192.168.0.1 - 192.168.0.126 126 192.168.0.128/25 192.168.0.128 - 192.168.0.255 192.168.0.129 - 192.168.0.254 126 192.168.1.0/25 192.168.1.0 - 192.168.1.127 192.168.1.1 - 192.168.1.126 126 192.168.1.128/25 192.168.1.128 - 192.168.1.255 192.168.1.129 - 192.168.1.254 126 192.168.2.0/25 192.168.2.0 - 192.168.2.127 192.168.2.1 - 192.168.2.126 126 192.168.2.128/25 192.168.2.128 - 192.168.2.255 192.168.2.129 - 192.168.2.254 126 192.168.3.0/25 192.168.3.0 - 192.168.3.127 192.168.3.1 - 192.168.3.126 126 192.168.3.128/25 192.168.3.128 - 192.168.3.255 192.168.3.129 - 192.168.3.254 126

If youre not tied to the range due to your ISP/Authority just make new ones with plenty space between and you can always extend

[ITJS2015]

Iv always been in environments where they are separated and for security that they cannot try and connect to other devices.

[ITJS2015]

It looks like going from 4 networks to 8 networks doesn't give me the flexibility to extend with no reserved IP.

 

So i think i would possibly need more for this to leave so reserved if when or need to increase.

[DGardiner]

even so, if you restart your ranges on a 10.x.x.x

 

10.1.1.x STAFF WIFI

10.2.1.x PUPILS WIFI

etc

 

that gives you an obscene available range in every vlan its personaly do them all /23 which gives you 512 addresses bump that up if you need more and start from there

 

even if your current iprange you use in the flat state becomes your server range so you dont have to re-address your AD Servers etc its just a case of setting up iphelpers on each vlans gateway pointo to your dhcp server and it will all feed from there

[Aprice]

I'd have thought if you ask the upstream provider they can provide you with a larger address space. The previous companies we've worked with that use Fortigate have multiple VDOMs so can actually reuse the same range of internal addresses with different customers. I would hazard a guess this is also what the LA you're with is doing.

[Julian]

Some points,

 

1/ Vlans do not have to be the same size., you can use a small Vlan when there are only a few devices, and a larger vlan, for more devices. For example, you very proably have more students than CCTVs, so use a small er range for the CCTVs, and a larger one to allow for each student to have a mobile device

 

2/ Vlan have to be a power of 2 in size -2, so you can have 6,14,30,62,126,254,510,1022,... devices in a vlan.

 

3/ Vlans need more avalable addreeses than a flat network, due to the size constraints of each vlan.