TheHyperTechie Posted April 19, 2024 Posted April 19, 2024 Hi all, When I inherited our network nearly 12 months ago it was just a basic/flat setup. We have about 450 wireless clients, and about 30 (mixture of voip phones, printers, desktops) wired devices now live on the network. I have been wanting to implement VLANs for a while, but just struggled to carry this out, amongst the long list of other stuff I have to do. My first goal is to separate each SSID and place them onto their own VLAN. So when someone connects to Guest for example, they recieve an IP from that dedicated subnet. I can then adjust the filtering and add these separate subnet ranges so devices get the correct filtering automatically. After setting these up, I will then look into creating VLANs for our wired devices, but currently we rely much more on our wireless system, so I believe this takes precedence. As our DHCP and DNS is all hosted router side by the ISP, I guess my first task is asking them to create these VLANs with the correct ranges and enable DHCP on them? I can then go into UniFi and add the VLANs and subnets. This will allow me to assign each SSID to the relevant VLAN. Can anyone see any further issues I might run into? Thanks.
wright-fi Posted April 20, 2024 Posted April 20, 2024 There is quite a bit to unpack here, so apologies if I miss anything. If your DHCP Server is managed by your ISP, you will need them to create a new scope. If the DHCP Server is in a different subnet to the new VLAN(s) you will need to setup dhcp relay, so that the client devices can find the DHCP Server. You will also need to create the new subnet, this would usually be created on the device that is the current default gateway of your network. This could be a Layer 3 Core Switch, router or firewall. This may be hosted by your ISP, as it could reside on the router. If it is from your ISP, it is important to know how the VLAN will be presented to your network switches, this could be a single port tagging all VLANs, a single port with a native VLAN and all other VLANs tagged, or multiple ports with a single untagged VLAN on each port. You will then need to start VLAN tagging, for the VLAN to move across the network every port carrying the traffic needs to have the correct VLAN tag in place. The devices that would need to be configured to use VLANs are likely be your router/core switch, uplink ports on all switches and the ports connecting to access points. It is important to remember that ports need to be tagged in both directions. If I were in your position, for connections between switches and access points, I would leave the native VLAN 1 as untagged, and tag all other VLANs. Over time you can created a dedicated VLAN for access points and switches, which is a good idea, but maybe one to review when your create VLANs for wired devices. Once all wired ports are tagged you can, as you rightly stated start to create SSID with VLAN tags on your Wi-Fi infrastructure. If this is your first time working with VLANs, starting on a network as large as yours is quite a daunting task, so you may want to seek some outside help. I hope this was helpful. 1
TheHyperTechie Posted April 21, 2024 Author Posted April 21, 2024 There is quite a bit to unpack here, so apologies if I miss anything. If your DHCP Server is managed by your ISP, you will need them to create a new scope. If the DHCP Server is in a different subnet to the new VLAN(s) you will need to setup dhcp relay, so that the client devices can find the DHCP Server. You will also need to create the new subnet, this would usually be created on the device that is the current default gateway of your network. This could be a Layer 3 Core Switch, router or firewall. This may be hosted by your ISP, as it could reside on the router. If it is from your ISP, it is important to know how the VLAN will be presented to your network switches, this could be a single port tagging all VLANs, a single port with a native VLAN and all other VLANs tagged, or multiple ports with a single untagged VLAN on each port. You will then need to start VLAN tagging, for the VLAN to move across the network every port carrying the traffic needs to have the correct VLAN tag in place. The devices that would need to be configured to use VLANs are likely be your router/core switch, uplink ports on all switches and the ports connecting to access points. It is important to remember that ports need to be tagged in both directions. If I were in your position, for connections between switches and access points, I would leave the native VLAN 1 as untagged, and tag all other VLANs. Over time you can created a dedicated VLAN for access points and switches, which is a good idea, but maybe one to review when your create VLANs for wired devices. Once all wired ports are tagged you can, as you rightly stated start to create SSID with VLAN tags on your Wi-Fi infrastructure. If this is your first time working with VLANs, starting on a network as large as yours is quite a daunting task, so you may want to seek some outside help. I hope this was helpful. Thank you so much for such an in-depth response, it helps a lot. One question, you stated 'Once all wired ports are tagged you can, as you rightly stated start to create SSID with VLAN tags on your Wi-Fi infrastructure' If I am just starting with the SSIDs, do I really need to tag all of the ports? I will be assigning each SSID to the relevant VLAN created on the switch. Doesn't this mean that when a client connects it will receive an IP address from that subnet and then in turn be on the correct VLAN? - This may be a silly question, but just wanted to confirm Thanks!
Aprice Posted April 21, 2024 Posted April 21, 2024 If I am just starting with the SSIDs, do I really need to tag all of the ports? I will be assigning each SSID to the relevant VLAN created on the switch. Doesn't this mean that when a client connects it will receive an IP address from that subnet and then in turn be on the correct VLAN? - This may be a silly question, but just wanted to confirm Thanks! The typical setup is for any WiFi point to be untagged on it's management VLAN, and tagged on all VLANs that SSIDs will be broadcast. e.g. WiFi MGMT - VLAN 20 - 10.20.0.0/24 Student Devices - VLAN - 30 10.30.0.0/24 Staff Devices - VLAN 40 - 10.40.0.0/24 Trust Devices VLAN 50 - 10.50.0.0/24 On the WiFi point switch ports you would have: untagged vlan 20 tagged vlan 30,40,50 In that example the AP would have an IP in the 10.20.0.0 range and a device connecting on Trust Devices - VLAN 50 would get an IP in the 10.50.0.0
TheHyperTechie Posted April 21, 2024 Author Posted April 21, 2024 The typical setup is for any WiFi point to be untagged on it's management VLAN, and tagged on all VLANs that SSIDs will be broadcast. e.g. WiFi MGMT - VLAN 20 - 10.20.0.0/24 Student Devices - VLAN - 30 10.30.0.0/24 Staff Devices - VLAN 40 - 10.40.0.0/24 Trust Devices VLAN 50 - 10.50.0.0/24 On the WiFi point switch ports you would have: untagged vlan 20 tagged vlan 30,40,50 In that example the AP would have an IP in the 10.20.0.0 range and a device connecting on Trust Devices - VLAN 50 would get an IP in the 10.50.0.0 Ok... I think I understand what you mean. So it would be best practice to actually have a separate VLAN for the WiFi points themselves? Then I would tag the ports with all of the separate SSID VLANs so it allows traffic through them all...? If I am assigning the SSIDs to the VLANs anyway, would it not just work without this extra step e.g creating another VLAN named WiFi. Again, sorry if the answer is obvious, I am just trying to gain as much info as possible Thanks!
Aprice Posted April 21, 2024 Posted April 21, 2024 (edited) Ok... I think I understand what you mean. So it would be best practice to actually have a separate VLAN for the WiFi points themselves? Then I would tag the ports with all of the separate SSID VLANs so it allows traffic through them all...? If I am assigning the SSIDs to the VLANs anyway, would it not just work without this extra step e.g creating another VLAN named WiFi. Again, sorry if the answer is obvious, I am just trying to gain as much info as possible Thanks! I'd say it's best practice to put the APs on their own, that way access to the management interface can be controlled easily. And management traffic kept separate from everything else. Our 'Standard' network for a Secondary maybe has 20 odd VLANS maybe more depending on the site. Here's an example of one of our older templates, they vary a lot depending on site layouts and the services they have. When we plan these networks we add a lot of extra capacity, for example they might only end up using 3 of the desktop VLANs but the extras are there. Often these end up repurposed later on for other things. You could not bother creating a management VLAN for the WiFi points and just dump them on VLAN 1, but it's so little extra effort to create it that you might as well. When we need to make firewall changes so that the APs can phone home to Aruba or our Unifi controller, we just make the change on the firewall to allow the whole of 10.20.12.0/24 to that destination. [TABLE=width: 1110] [TR] [TD=colspan: 10] Main Subnet - 10.20.0.0/19 [/TD] [/TR] [TR] [TD]VLAN ID[/TD] [TD]VLAN Name[/TD] [TD]Range[/TD] [TD]Mask[/TD] [TD]Bits[/TD] [TD]Gateway[/TD] [TD]Broadcast[/TD] [TD]Start[/TD] [TD]Finish[/TD] [TD]Hosts[/TD] [/TR] [/TABLE] [TABLE=width: 1110] [TR] [TD]1[/TD] [TD]Default - To be disused[/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [/TR] [TR] [TD]2[/TD] [TD]Guest_WiFi[/TD] [TD]10.20.0.0[/TD] [TD]255.255.252.0[/TD] [TD]22[/TD] [TD]10.20.0.1[/TD] [TD]10.20.3.255[/TD] [TD]10.20.0.2[/TD] [TD]10.20.3.254[/TD] [TD]1024[/TD] [/TR] [TR] [TD]3[/TD] [TD]Staff_WiFi[/TD] [TD]10.20.4.0[/TD] [TD]255.255.252.0[/TD] [TD]22[/TD] [TD]10.20.4.1[/TD] [TD]10.20.7.255[/TD] [TD]10.20.4.2[/TD] [TD]10.20.7.254[/TD] [TD]1024[/TD] [/TR] [TR] [TD]4[/TD] [TD]Devices_WiFi[/TD] [TD]10.20.8.0[/TD] [TD]255.255.252.0[/TD] [TD]22[/TD] [TD]10.20.8.1[/TD] [TD]10.20.11.255[/TD] [TD]10.20.8.2[/TD] [TD]10.20.11.254[/TD] [TD]1024[/TD] [/TR] [TR] [TD]5[/TD] [TD]WiFi Management[/TD] [TD]10.20.12.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.12.1[/TD] [TD]10.20.12.255[/TD] [TD]10.20.12.2[/TD] [TD]10.20.12.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]6[/TD] [TD]Desktops 1[/TD] [TD]10.20.13.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.13.1[/TD] [TD]10.20.13.255[/TD] [TD]10.20.13.2[/TD] [TD]10.20.13.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]7[/TD] [TD]Desktops 2[/TD] [TD]10.20.14.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.14.1[/TD] [TD]10.20.14.255[/TD] [TD]10.20.14.2[/TD] [TD]10.20.14.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]8[/TD] [TD]Desktops 3[/TD] [TD]10.20.15.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.15.1[/TD] [TD]10.20.15.255[/TD] [TD]10.20.15.2[/TD] [TD]10.20.15.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]9[/TD] [TD]Desktops 4[/TD] [TD]10.20.16.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.16.1[/TD] [TD]10.20.16.255[/TD] [TD]10.20.16.2[/TD] [TD]10.20.16.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]10[/TD] [TD]Desktops 5[/TD] [TD]10.20.17.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.17.1[/TD] [TD]10.20.17.255[/TD] [TD]10.20.17.2[/TD] [TD]10.20.17.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]11[/TD] [TD]Desktops 6[/TD] [TD]10.20.18.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.18.1[/TD] [TD]10.20.18.255[/TD] [TD]10.20.18.2[/TD] [TD]10.20.18.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]12[/TD] [TD]IP AUDIO[/TD] [TD]10.20.19.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.19.1[/TD] [TD]10.20.19.255[/TD] [TD]10.20.19.2[/TD] [TD]10.20.19.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]13[/TD] [TD]Cashless Catering[/TD] [TD]10.20.20.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.20.1[/TD] [TD]10.20.20.255[/TD] [TD]10.20.20.2[/TD] [TD]10.20.20.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]14[/TD] [TD]BMS[/TD] [TD]10.20.21.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.21.1[/TD] [TD]10.20.21.255[/TD] [TD]10.20.21.2[/TD] [TD]10.20.21.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]15[/TD] [TD]Access Control[/TD] [TD]10.20.22.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.22.1[/TD] [TD]10.20.22.255[/TD] [TD]10.20.22.2[/TD] [TD]10.20.22.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]16[/TD] [TD]Servers[/TD] [TD]10.20.23.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.23.1[/TD] [TD]10.20.23.255[/TD] [TD]10.20.23.2[/TD] [TD]10.20.23.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]17[/TD] [TD]Switch Management[/TD] [TD]10.20.24.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.24.1[/TD] [TD]10.20.24.255[/TD] [TD]10.20.24.2[/TD] [TD]10.20.24.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]18[/TD] [TD]IT Office Network[/TD] [TD]10.20.25.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.25.1[/TD] [TD]10.20.25.255[/TD] [TD]10.20.25.2[/TD] [TD]10.20.25.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]19[/TD] [TD]Printers[/TD] [TD]10.20.26.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.26.1[/TD] [TD]10.20.26.255[/TD] [TD]10.20.26.2[/TD] [TD]10.20.26.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]20[/TD] [TD]VOIP[/TD] [TD]10.20.27.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.27.1[/TD] [TD]10.20.27.255[/TD] [TD]10.20.27.2[/TD] [TD]10.20.27.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]21[/TD] [TD]CCTV[/TD] [TD]10.20.28.1[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.28.1[/TD] [TD]20.20.28.255[/TD] [TD]10.20.28.2[/TD] [TD]10.20.28.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]700[/TD] [TD]Transit[/TD] [TD]172.16.10.0[/TD] [TD]255.255.255.248[/TD] [TD]29[/TD] [TD]172.16.10.1[/TD] [TD]172.16.10.7[/TD] [TD]172.16.10.2[/TD] [TD]172.16.10.6[/TD] [TD]6[/TD] [/TR] [/TABLE] Personally we dislike having ISPs managing firewalls for us, we prefer the flexibility and ease of having local access. We've had a lot of frustration in the past where what we asked for was not what was implemented by the ISP, then proving this and the back and forth just wastes time and causes a lot of frustration. In your case though creating 3 or 4 new VLANs for some WiFi I wouldn't have thought would be a problem. Edited April 21, 2024 by Aprice 1
wright-fi Posted April 21, 2024 Posted April 21, 2024 Thank you so much for such an in-depth response, it helps a lot. One question, you stated 'Once all wired ports are tagged you can, as you rightly stated start to create SSID with VLAN tags on your Wi-Fi infrastructure' If I am just starting with the SSIDs, do I really need to tag all of the ports? I will be assigning each SSID to the relevant VLAN created on the switch. Doesn't this mean that when a client connects it will receive an IP address from that subnet and then in turn be on the correct VLAN? - This may be a silly question, but just wanted to confirm Thanks! Yes, you will need to tag all of the ports. By all ports I mean (uplink ports on all switches and the ports connecting to access points). If you tag the SSID with a VLAN, but the switchport is not configured to use that VLAN, the switch won't know what to do with the VLAN tag and will drop the packet.
PotNoodleTech Posted April 22, 2024 Posted April 22, 2024 That's quite the impressive Vlan template Aprice!!
TheHyperTechie Posted April 22, 2024 Author Posted April 22, 2024 I'd say it's best practice to put the APs on their own, that way access to the management interface can be controlled easily. And management traffic kept separate from everything else. Our 'Standard' network for a Secondary maybe has 20 odd VLANS maybe more depending on the site. Here's an example of one of our older templates, they vary a lot depending on site layouts and the services they have. When we plan these networks we add a lot of extra capacity, for example they might only end up using 3 of the desktop VLANs but the extras are there. Often these end up repurposed later on for other things. You could not bother creating a management VLAN for the WiFi points and just dump them on VLAN 1, but it's so little extra effort to create it that you might as well. When we need to make firewall changes so that the APs can phone home to Aruba or our Unifi controller, we just make the change on the firewall to allow the whole of 10.20.12.0/24 to that destination. [TABLE=width: 1110] [TR] [TD=colspan: 10] Main Subnet - 10.20.0.0/19 [/TD] [/TR] [TR] [TD]VLAN ID[/TD] [TD]VLAN Name[/TD] [TD]Range[/TD] [TD]Mask[/TD] [TD]Bits[/TD] [TD]Gateway[/TD] [TD]Broadcast[/TD] [TD]Start[/TD] [TD]Finish[/TD] [TD]Hosts[/TD] [/TR] [/TABLE] [TABLE=width: 1110] [TR] [TD]1[/TD] [TD]Default - To be disused[/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [TD][/TD] [/TR] [TR] [TD]2[/TD] [TD]Guest_WiFi[/TD] [TD]10.20.0.0[/TD] [TD]255.255.252.0[/TD] [TD]22[/TD] [TD]10.20.0.1[/TD] [TD]10.20.3.255[/TD] [TD]10.20.0.2[/TD] [TD]10.20.3.254[/TD] [TD]1024[/TD] [/TR] [TR] [TD]3[/TD] [TD]Staff_WiFi[/TD] [TD]10.20.4.0[/TD] [TD]255.255.252.0[/TD] [TD]22[/TD] [TD]10.20.4.1[/TD] [TD]10.20.7.255[/TD] [TD]10.20.4.2[/TD] [TD]10.20.7.254[/TD] [TD]1024[/TD] [/TR] [TR] [TD]4[/TD] [TD]Devices_WiFi[/TD] [TD]10.20.8.0[/TD] [TD]255.255.252.0[/TD] [TD]22[/TD] [TD]10.20.8.1[/TD] [TD]10.20.11.255[/TD] [TD]10.20.8.2[/TD] [TD]10.20.11.254[/TD] [TD]1024[/TD] [/TR] [TR] [TD]5[/TD] [TD]WiFi Management[/TD] [TD]10.20.12.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.12.1[/TD] [TD]10.20.12.255[/TD] [TD]10.20.12.2[/TD] [TD]10.20.12.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]6[/TD] [TD]Desktops 1[/TD] [TD]10.20.13.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.13.1[/TD] [TD]10.20.13.255[/TD] [TD]10.20.13.2[/TD] [TD]10.20.13.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]7[/TD] [TD]Desktops 2[/TD] [TD]10.20.14.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.14.1[/TD] [TD]10.20.14.255[/TD] [TD]10.20.14.2[/TD] [TD]10.20.14.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]8[/TD] [TD]Desktops 3[/TD] [TD]10.20.15.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.15.1[/TD] [TD]10.20.15.255[/TD] [TD]10.20.15.2[/TD] [TD]10.20.15.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]9[/TD] [TD]Desktops 4[/TD] [TD]10.20.16.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.16.1[/TD] [TD]10.20.16.255[/TD] [TD]10.20.16.2[/TD] [TD]10.20.16.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]10[/TD] [TD]Desktops 5[/TD] [TD]10.20.17.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.17.1[/TD] [TD]10.20.17.255[/TD] [TD]10.20.17.2[/TD] [TD]10.20.17.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]11[/TD] [TD]Desktops 6[/TD] [TD]10.20.18.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.18.1[/TD] [TD]10.20.18.255[/TD] [TD]10.20.18.2[/TD] [TD]10.20.18.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]12[/TD] [TD]IP AUDIO[/TD] [TD]10.20.19.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.19.1[/TD] [TD]10.20.19.255[/TD] [TD]10.20.19.2[/TD] [TD]10.20.19.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]13[/TD] [TD]Cashless Catering[/TD] [TD]10.20.20.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.20.1[/TD] [TD]10.20.20.255[/TD] [TD]10.20.20.2[/TD] [TD]10.20.20.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]14[/TD] [TD]BMS[/TD] [TD]10.20.21.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.21.1[/TD] [TD]10.20.21.255[/TD] [TD]10.20.21.2[/TD] [TD]10.20.21.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]15[/TD] [TD]Access Control[/TD] [TD]10.20.22.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.22.1[/TD] [TD]10.20.22.255[/TD] [TD]10.20.22.2[/TD] [TD]10.20.22.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]16[/TD] [TD]Servers[/TD] [TD]10.20.23.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.23.1[/TD] [TD]10.20.23.255[/TD] [TD]10.20.23.2[/TD] [TD]10.20.23.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]17[/TD] [TD]Switch Management[/TD] [TD]10.20.24.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.24.1[/TD] [TD]10.20.24.255[/TD] [TD]10.20.24.2[/TD] [TD]10.20.24.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]18[/TD] [TD]IT Office Network[/TD] [TD]10.20.25.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.25.1[/TD] [TD]10.20.25.255[/TD] [TD]10.20.25.2[/TD] [TD]10.20.25.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]19[/TD] [TD]Printers[/TD] [TD]10.20.26.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.26.1[/TD] [TD]10.20.26.255[/TD] [TD]10.20.26.2[/TD] [TD]10.20.26.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]20[/TD] [TD]VOIP[/TD] [TD]10.20.27.0[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.27.1[/TD] [TD]10.20.27.255[/TD] [TD]10.20.27.2[/TD] [TD]10.20.27.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]21[/TD] [TD]CCTV[/TD] [TD]10.20.28.1[/TD] [TD]255.255.255.0[/TD] [TD]24[/TD] [TD]10.20.28.1[/TD] [TD]20.20.28.255[/TD] [TD]10.20.28.2[/TD] [TD]10.20.28.254[/TD] [TD]254[/TD] [/TR] [TR] [TD]700[/TD] [TD]Transit[/TD] [TD]172.16.10.0[/TD] [TD]255.255.255.248[/TD] [TD]29[/TD] [TD]172.16.10.1[/TD] [TD]172.16.10.7[/TD] [TD]172.16.10.2[/TD] [TD]172.16.10.6[/TD] [TD]6[/TD] [/TR] [/TABLE] Personally we dislike having ISPs managing firewalls for us, we prefer the flexibility and ease of having local access. We've had a lot of frustration in the past where what we asked for was not what was implemented by the ISP, then proving this and the back and forth just wastes time and causes a lot of frustration. In your case though creating 3 or 4 new VLANs for some WiFi I wouldn't have thought would be a problem. Great, thank you for such an in-depth response. It helps a lot! You have ALOT of addresses haha! We have 1022 addresses within our main subnet. I see what you mean about having the separate Wi-Fi VLAN too. It just makes it a bit neater and groups all of the UniFi kit together as well. I would then make the native VLAN on the ports connected to the WAPs 'Wi-Fi' but allow all of the other VLANs (SSIDs) through them? This way devices would still receive an address from that particular VLANs subnet, and the access points will be able to communicate between all 3 SSIDs... I hope this is right? please tell me if not! If I follow this route, would the devices not be able communicate between the VLANs? or would they as I am allowing all of the VLANs through the WAPs/switch ports?
Davit2005 Posted April 22, 2024 Posted April 22, 2024 (edited) Great, thank you for such an in-depth response. It helps a lot! You have ALOT of addresses haha! We have 1022 addresses within our main subnet. I see what you mean about having the separate Wi-Fi VLAN too. It just makes it a bit neater and groups all of the UniFi kit together as well. I would then make the native VLAN on the ports connected to the WAPs 'Wi-Fi' but allow all of the other VLANs (SSIDs) through them? This way devices would still receive an address from that particular VLANs subnet, and the access points will be able to communicate between all 3 SSIDs... I hope this is right? please tell me if not! If I follow this route, would the devices not be able communicate between the VLANs? or would they as I am allowing all of the VLANs through the WAPs/switch ports? Yep with Unifi and some other APs you normally untag (or native) the management then tag (or trunk) the vlans that are being used by the SSIDs. Our APs work a bit different as are the controllers do all the work and the APs once setup are paperweights without the controllers. The APs in our case form a tunnel to the controller but they can be on any vlan. Separating devices into different vlans splits up your network into broadcast domain limiting effect of switching loops although using spanning tree should prevent them. Edited April 22, 2024 by Davit2005 1
Aprice Posted April 22, 2024 Posted April 22, 2024 Great, thank you for such an in-depth response. It helps a lot! You have ALOT of addresses haha! We have 1022 addresses within our main subnet. I see what you mean about having the separate Wi-Fi VLAN too. It just makes it a bit neater and groups all of the UniFi kit together as well. I would then make the native VLAN on the ports connected to the WAPs 'Wi-Fi' but allow all of the other VLANs (SSIDs) through them? This way devices would still receive an address from that particular VLANs subnet, and the access points will be able to communicate between all 3 SSIDs... I hope this is right? please tell me if not! If I follow this route, would the devices not be able communicate between the VLANs? or would they as I am allowing all of the VLANs through the WAPs/switch ports? Yeah, the address size you've got was a common thing we've seen with these LGFL / KCOM type networks. There are ways around it and some creative options, but it's just another reason we don't like working with them. This way devices would still receive an address from that particular VLANs subnet, and the access points will be able to communicate between all 3 SSIDs... I hope this is right? please tell me if not! The access point won't route traffic between the VLANs (unless it's doing L3 on the AP, which yours almost certainly are not). But your site router will route it between unless something is put in place like an ACL or firewall rule to stop it. 1
TheHyperTechie Posted April 22, 2024 Author Posted April 22, 2024 Yeah, the address size you've got was a common thing we've seen with these LGFL / KCOM type networks. There are ways around it and some creative options, but it's just another reason we don't like working with them. This way devices would still receive an address from that particular VLANs subnet, and the access points will be able to communicate between all 3 SSIDs... I hope this is right? please tell me if not! The access point won't route traffic between the VLANs (unless it's doing L3 on the AP, which yours almost certainly are not). But your site router will route it between unless something is put in place like an ACL or firewall rule to stop it. Great, thanks. So essentially unless I add in any ACLs on the router, devices will still communicate freely between each SSID and VLAN. I suppose this is fine, to be honest it would be the 'Guest' SSID I would want isolating. Thank you for explaining, you have helped understand a lot.
Davit2005 Posted April 22, 2024 Posted April 22, 2024 Great, thanks. So essentially unless I add in any ACLs on the router, devices will still communicate freely between each SSID and VLAN. I suppose this is fine, to be honest it would be the 'Guest' SSID I would want isolating. Thank you for explaining, you have helped understand a lot. It can depend when it comes to the firewall. Some firewalls deny by default between different interfaces/zones where as others allow by default, you'd need to check with your firewall how it works. But yep allow minimum to internal or better, nothing :-) 1
TheHyperTechie Posted April 22, 2024 Author Posted April 22, 2024 Yeah, the address size you've got was a common thing we've seen with these LGFL / KCOM type networks. There are ways around it and some creative options, but it's just another reason we don't like working with them. This way devices would still receive an address from that particular VLANs subnet, and the access points will be able to communicate between all 3 SSIDs... I hope this is right? please tell me if not! The access point won't route traffic between the VLANs (unless it's doing L3 on the AP, which yours almost certainly are not). But your site router will route it between unless something is put in place like an ACL or firewall rule to stop it. Quick question, All of our access points (~20) have statically assigned IP addresses. When creating the 'Wi-Fi' VLAN for them to reside in, would I just request my ISP to create a range for where they start and end. E.g .21 > .41...?
Davit2005 Posted April 22, 2024 Posted April 22, 2024 (edited) Quick question, All of our access points (~20) have statically assigned IP addresses. When creating the 'Wi-Fi' VLAN for them to reside in, would I just request my ISP to create a range for where they start and end. E.g .21 > .41...? There is normally nothing wrong with using DHCP for the AP management and if you are using Unifi (and other WiFi controllers) you can easily see what IP address an AP has. Jus be careful when you change over to DHCP to not have the DHCP server give out an address that is assigned to a different AP statically. Edited April 22, 2024 by Davit2005
Aprice Posted April 22, 2024 Posted April 22, 2024 Quick question, All of our access points (~20) have statically assigned IP addresses. When creating the 'Wi-Fi' VLAN for them to reside in, would I just request my ISP to create a range for where they start and end. E.g .21 > .41...? They'll give you a subnet, and a default gateway address. I'd suggest asking for something like a /26 subnet (255.255.255.192) which would give you 64 addresses. Also the same for the WiFi SSIDs if you want them on their own VLANs then each will need their own range. Maybe 192.168.4.0/24 192.168.5.0/24 192.168.6.0/24 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now