VLAN tagging - Extreme noob question!

[EmperorPeng]

We had 3rd party network support and they set up a lot of our network infrastructure. I have been tasked with taking over this part of the network and have a query about the switch configs re: VLANS.

 

We have three VLANS (two really I guess, the default one plus an 'Internet' VLAN with an ID of 3 and a 'Guest Users' VLAN with an ID of 5.)

 

The switch is set up so that ports 1-24 are untagged for the default VLAN, ports 1-24 are all tagged for the Internet VLAN (3) and also tagged for the Guest Users VLAN (5)

 

Sorry for the noob question, but what are the implications of having this config? I know next to nothing about VLANS but it seems that doing it like this defeats the object of having a VLAN in the first place? I really could do with an idiots guide to VLANS as it is one area that I am woefully ignorant about. If the above config is fine and I want to add another switch, I would presumably just set the VLANS up in the exact same way?

 

Thanks

[Davit2005]

Personally I'd only have vlans on ports that need it, so this set up sounds like they have configured every port the same for ease of admin i.e. could put an AP in any port. Trunk ports should not have any client vlans untagged either in my view. Good practice should be used whether it is seen as necessary or not in my own opinion but maybe that is jus me :-)

 

Below and other YouTube videos might get you started

 

[TechMonkey]

Yeah, as Davit2005 says that is setup to be the bare minimum and no need for any admin, which is lazy rather than good. The implications are that anyone plugging in a device has access to anything if the port is patched so you may as well not have VLANs at all.

 

Personally, I would set up more VLANs, to segregate out certain devices like Printers and WiFi, and then assign only those needed to each port and except in certain circumstances this would be one VLAN per port.

[mavhc]

Is the guests users for WiFi? How is the wifi setup?

[JRA]

I have been tasked with taking over this part of the network

 

What training will they be giving you?

 

EDIT - To add though, I don't think these are "noob questions" at all this is an intelligent thing to be asking and on top of that to suspect that setup is silly. Frankly it does seem to be. VLANS and the complexities of networking are full of penny drop moments, you'll see that as you go.

Edited April 15, 2024 by JRA

[Olliedawg]

What training will they be giving you?

 

Dont be silly

[TheHyperTechie]

I would say they have definitely done this out of ease. So all devices connected to that switch can communicate between the VLANs. The VLANs can then be adjusted on a 'per port' basis if and when you require them.

[Chris_Cook]

You need to make sure you have some good documentation and labeling once you have VLans.

 

If its only Access points or other switches connected to these ports then that's fine - your Wi-Fi system should take care of putting people on the right VLan. Its probably 1 VLan per SSID.

 

Having a VLan called "Internet" probably isn't the most useful thing, unless that is just for your internet connection. It all depends on how you are segregating your users and devices.

 

If you have PCs (Especially if BYOD) then there are 2 risks - one of VLan hoping where people can jump onto the other VLans, and the other is running Wireshark and being able to sniff some of the traffic (probably only Broad and multi cast traffic like ARP, DNS and its various multicast alternatives).

 

In an ideal world, VLans should only be tagged on ports they need to be on.

 

I'd go back to the installer and ask for some documentation and design.

[pablo007]

The setup you describe seems perfectly normal for a core switch, all ports on a core switch are effectively up link ports to other switches which need to be trunk ports to allow the various vlans through to the edge switches. so if the switch you describe is at the center of your network its fine.

 

 

Your edge switches (those at varying locations around the building) should have the coresponding port that connects to the core switch as a trunk as well but the remaining access ports should be set to default and then any ports that have waps connected to them should be also be trunk ports so that they can pass ips and traffice to the relevant vlans asscoiated with the ssids.

[Aprice]

Just looks to be a poor setup to be honest, as everyone else says only tag what's needed.

[Jcx500]

What Switches are they?

[EmperorPeng]

Is the guests users for WiFi? How is the wifi setup?

Correct, the 'Guest Users' VLAN is for a guest WiFi network that's on a different IP range.

[mavhc]

Correct, the 'Guest Users' VLAN is for a guest WiFi network that's on a different IP range.

 

So the Guest Vlan is only used by the WiFi APs, although in theory you could add a wired Guest computer. Only problem would be if someone wanted to use the guest vlan to avoid filtering and had the ability to pick their vlan on a wired machine.

 

What's the internet vlan for, any idea?

[EmperorPeng]

So the Guest Vlan is only used by the WiFi APs, although in theory you could add a wired Guest computer. Only problem would be if someone wanted to use the guest vlan to avoid filtering and had the ability to pick their vlan on a wired machine.

 

What's the internet vlan for, any idea?

 

The guest VLAN is filtered in exactly the same way as the 'normal' VLAN - they both go through our web filter, it's just that the guest VLAN users are seen as 'unauthenticated users' so the filter only recognises them by machine IP address. I have no idea what the 'Internet' VLAN is for given that everything has Internet anyway!

[EmperorPeng]

What Switches are they?

Various models of D-Link. Some are new, some are going back 10 years such as the 3024s

[EmperorPeng]

Dont be silly

 

This guy gets it!

[pablo007]

I have no idea what the 'Internet' VLAN is for given that everything has Internet anyway!

do you use an upstream internet provider such as swgfl or empsn rather than a direct feed and your own firewall, if so the internet vlan will be what connects to that.

[EmperorPeng]

do you use an upstream internet provider such as swgfl or empsn rather than a direct feed and your own firewall, if so the internet vlan will be what connects to that.

 

No, we have direct fibre and our own firewall. I'm sure there must be a reason for it otherwise why would it be there, right?

[mavhc]

Are any devices using it? What's handing out IP addresses for it, are any in use?

[pablo007]

No, we have direct fibre and our own firewall. I'm sure there must be a reason for it otherwise why would it be there, right?

 

Take a look at the running config on your core switch specifically the port that plugs directly into the router that provides the internet connection, that should provide the answer, it may have an ip address attached to the vlan that is in the same range as the router.

[EmperorPeng]

Are any devices using it? What's handing out IP addresses for it, are any in use?

The guest network is used and gets IP addresses on a different scope to our main network. I don't know what the 'Internet' VLAN is for

[Davit2005]

The guest network is used and gets IP addresses on a different scope to our main network. I don't know what the 'Internet' VLAN is for

 

Is there any documentation at all for the network? If not I'd get on with making some. Even if it jus means drawing something up rough. Do you have access to the firewall and all the switches?

 

You want to get some documentation done incase you have a problem for one. Is the org supported by the in house IT dept. with no 3rd party support setup?

[EmperorPeng]

Is there any documentation at all for the network? If not I'd get on with making some. Even if it jus means drawing something up rough. Do you have access to the firewall and all the switches?

 

You want to get some documentation done incase you have a problem for one. Is the org supported by the in house IT dept. with no 3rd party support setup?

 

We have:

 

A network map of connections which just shows fibre links between buildings.

A list of switches present in each cabinet along with their IP addresses for the GUI.

A plan for each room showing network socket locations and which cabinet/switch they are supposed to go to.

 

Switches are set up 'daisy chained' e.g. port 24 of one switch links to port 23 of the next switch, and 24 of that switch links to 23 of the next switch etc.

 

STP is not enabled on the network. We have had 'network loops' before due to students connecting a socket to a socket so this is something that I am looking at implementing.

 

I do have access to the firewall and the switches.

 

The in-house IT support is two people. The company who set up most of the network is no longer viable. We are looking at getting network specialists in to upgrade some switches and redesign the network re: more efficient layout/config and upgrading the fibre links between buildings from 1Gbps to 10Gbps

[mavhc]

So we know what the guest vlan is for, and it only needs to be on ports where wifi APs are plugged in.

 

Internet VLAN, check firewall, router, see if it's used by anything

 

Enabled STP, it's simple, nothing should go wrong.

 

Where are the switches physically?

[Davit2005]

We have:

 

A network map of connections which just shows fibre links between buildings.

A list of switches present in each cabinet along with their IP addresses for the GUI.

A plan for each room showing network socket locations and which cabinet/switch they are supposed to go to.

 

Switches are set up 'daisy chained' e.g. port 24 of one switch links to port 23 of the next switch, and 24 of that switch links to 23 of the next switch etc.

 

STP is not enabled on the network. We have had 'network loops' before due to students connecting a socket to a socket so this is something that I am looking at implementing.

 

I do have access to the firewall and the switches.

 

The in-house IT support is two people. The company who set up most of the network is no longer viable. We are looking at getting network specialists in to upgrade some switches and redesign the network re: more efficient layout/config and upgrading the fibre links between buildings from 1Gbps to 10Gbps

 

OK so you are part there by the sounds of it :-). So if you get on the firewall (and core switch if you have one) and start with a logical diagram i.e. Internet vlan gateway on Core switch has this IP, BYOD/guest vlan gateway on firewall has this IP, etc.

 

Setting up STP will help if the switches support it but make sure you stick with one protocol and should not mix RSTP with MSTP etc. as @mavhc says implementing STP should be low risk. Use of vlans will break up the site into smaller broadcast domains which will lessen the impact of switching loops to the area rather than the whole network.

Edited April 17, 2024 by Davit2005