To Vlan or not Vlan?

[SYNACK]

Created the new VLAN on the network card of the DHCP server giving it a name of ITSupp_VLAN and and ID of 120. The ip address of the virtual network card is 192.168.12.252 subnet 255.255.255.0

 

Created a new scope for the range 192.168.12.1 - 192.168.12.250 in DHCP with a lease time of 7 days. Set the options [Router: 192.168.12.254] [DNS servers: 10.0.0.3, 10.0.0.5] and [DNS Domain Name: monmouth.local]

 

Not sure that I can be much help with the hp configuration but I was just wondering about your setup of the VLANS.

 

Is there any reason why you are not using a DHCP helper address on the VLAN ports that points to the location of an existing DHCP server with those extra scopes created. This would save you from having to create a large number of virtual interfaces on the DHCP server and prevent it from getting flooded by the broadcasts from all of your seporate VLANS as technically with that setup it would be directly connected to all of them.

 

These two threads may be worth a read:

http://www.edugeek.net/forums/networks/22320-hp-procurve-valns-help.html

http://www.edugeek.net/forums/networks/9550-vlan-clarification-required.html

[Andi]

Well that's how the guy that came in and set it up did it. I'd be interested in hearing/reading up on that helper address though.

[Theblacksheep]

for setting the IP helper-address on HP compatable equipment type:

 

telnet

config

vl

ip igmp

ip helper-address

wr me

 

 

You'll need to be using a port assigned to the DEFAULT VLAN. vl is the number referring to your VLAN. Doing IGMP here is quicker than GUI. IP HELPER-ADDRESS will be needed for each VLAN. Like linux, hitting TAB fills in the command out of the choices available.

 

After telnetting the device, type 'menu' and have a look around. Also type: SH RUN for your switch configuration and you can see how the other VLANS are setup.

 

I'd advise having a good read of the switch manuals (you can look them up on the HP site) they are pretty good and explain alot.

Edited August 7, 2008 by Theblacksheep

[SYNACK]

Well that's how the guy that came in and set it up did it. I'd be interested in hearing/reading up on that helper address though.

 

The DHCP helper feature allow the switch to forward DHCP requests to a DHCP server on a different subnet which stops you from having to set up a dhcp server for every vlan or link your DHCP server into all of the vlans. As long as the switch is running routing or knows how to get to the ip address of the DHCP server that you specify it can pass along the request. As the request shows up as being from the network interface of the vlan in question the DHCP server knows which address range it is and is able to send back a responce to the client through the switch. This will also stop any leakage that may occour through the DHCP server.

 

There is more information about it in the first of those two threads but the command to activate it is like this (source):

vlan 3
  name "CURRIC"
  ip address 192.168.56.1 255.255.252.0
  [b]ip helper-address 192.168.0.3[/b]
  tagged 1-24
  ip igmp
  exit

[Andi]

That looks really helpful, thanks.

 

Presumably then, the ip helper tells the computer requesting an IP address where to find one, then the DHCP server works out which scope that it should assign from?

 

So I can get rid off all the virtual LAN adapters from my DHCP server? In all honesty I was kind of worried about having a server with 30 plus network cards in it.

 

Thanks again for that, but do you have any idea why I'm not getting an IP address for the new vlan I setup today? I believe that if I can sort that, and then implement the IP helper address I can get flying on structuring this network.

[Andi]

Thanks Synack, I was still typing whilst you replied with your explanation.

 

Brilliant, I'll look into that some more then.

[Andi]

Thanks to all that got back to me in this thread, even though it wasn't mine to begin with! I now have made good progress in setting up VLans throughout the school using the ip helper address instead of having a virtual lan adapter for each segment.

 

CHEERS!!!!!

[Theblacksheep]

Once niggle I found was that PCs joined the default VLAN even though the ports the PCs were connected to were setup for other VLANS.

 

Instead of reserving the IPs for each PC in the correct VLAN, simply deactivate the default VLAN (making sure all your important stuff has fixed IPs or you'll be in trouble) and they'll find the right VLAN, then reactivate it afterwards.

 

Just setup ACLs for the pupil minibooks and teacher laptops, again, bit fiddly but once again the multiple HP manuals explain everything in great detail.

 

Anyone know a good (free) syslogger for Vista that handles port logging violations??? Most of the 'free' once I've found so far only handle the 'exceptions' requiring an upgrade to paid versions to get all logging. Annoying.

 

 

Edit: Syslog Watcher Personal is probably the best i've found so far...

Edited August 19, 2008 by Theblacksheep

[Joedetic]

Tried Kiwi Syslogd?

 

Kiwi Enterprises - Home