reggiep Posted January 21, 2009 Posted January 21, 2009 I really feel like I must have missed out somewhere in my life as I have never had to use or set up a VLAN. Can anybody point me to some easy documentation on the subject? I think I need to pick it up as I'm about to move our system from CC3 to vanilla and by the looks of it this would help! Thanks
Butuz Posted January 21, 2009 Posted January 21, 2009 Great thread - I need to do exactly the same never used vlans or been on any courses like that - need to implement vlans in April/May. Idiots guides more than welcome!! Particularly with HP Procurve! Butuz
Theblacksheep Posted January 21, 2009 Posted January 21, 2009 (edited) Butuz. If you are keeping CC3, you cant re/build PCs that are in a VLAN without a DC. The RM solution is to put a DC in each VLAN, however you probably want all your servers in one VLAN (ours go in the Default_vlan) on the same as switches. We have VLANS for servers and switches, admin PCs, Teacher Laptops, minibooks and 7 different vlans for different parts of the school (great for loopbacks). I'll be changing this soon with VLANS for printers, it office and various additional VLANS for the VM infrastructure. Not been on a course I just learnt vlans from this site, the various threads that run on it and the switch manuals I'd highly recommend reading all the manuals for your core switches (advance traffic guide etc), as most vlans stuff seems to be in Cisco format but the HP manuals give a great amount of info, to be honest pretty much all you need. There are only slight linguistic changes for procurve, but they can be confusing (trunking/tagged ports etc). Edited January 21, 2009 by Theblacksheep 1
K.C.Leblanc Posted January 21, 2009 Posted January 21, 2009 Have a look at these. ftp://ftp.hp.com/pub/networking/software/AdvTraff-Oct2005-59908853-Chap02-VLAN.pdf ftp://ftp.hp.com/pub/networking/software/AdvTraff-Oct2005-59908853-Chap03-GVRP.pdf 2
Zimmer Posted January 21, 2009 Posted January 21, 2009 Two years ago we was having major issues with broadcast traffic on our LAN, with over 1300 workstations and (at the time) over 100 3Com switches our network was being killed by unwanted traffic. The entire network was on 10.x.x.x IP addressing. We decided to split our network into VLAN's, the idea was to have a VLAN for each buildings floor. We ended up with 14 VLAN's in total, plus the original 10.x.x.x base VLAN which the servers and core kit still live on. We used 192.168.x.x IP addressing for the individual VLAN's, each VLAN having its own gateway. The gateway being the networks core switch (3Com 5500G) configured with multiple IP interfaces. The original VLAN setup was fairly complex, at the time we had three core switches in different geographical locations so we had to use VLAN trunking between the cores. Now we have only one single core switch so we simply untag the required VLAN on the fibre port needed. Now we are looking at the 3Com managed WiFi products and it looks like we are going to have to trunk a new VLAN to specific ports on edge switches around the campus - Oh the joy
dyoung5 Posted January 21, 2009 Posted January 21, 2009 I'm looking for the same thing. Perhaps if a few techs/managers who have implemented it could let us know some of the pains and gains involved. A few things I don't know are: How does this work with the LA/RBC supplied WANs? Do we get a seperate range for each network, or do we use NAT? can we subnet our current range to split it up? What about DHCP? I know you can use a "relay agent", but how does that work? How does the DHCP server know which pool to allocate the addresses from? How have people VLANed their network? By location, type of device, e.g. Printers, wireless, servers, desktops, or another way? What about RADIUS and 802.1x? Has anyone implemented that? If so, what are the implications, ect? And finally routing. How is the routing setup? Can we secure different VLANs? e.g. limit to internet access only, imaging server only, etc. Sorry to just throw loads of questions out like this. I don't expect them to all be answered, but maybe someone could setup a wiki entry for the subject or something. Regards, David
Zimmer Posted January 21, 2009 Posted January 21, 2009 (edited) As you say, for DHCP we use a relay agent on our core switch. Our core switch is also acting as the 'router' between all the VLAN's (as it is the default gateway for all devices). So our core switch basically has 15 IP addresses, one primary one for the 10.x.x.x network and an additional 14 secondary IP's for all the VLAN's. The DHCP relay agent is easy to configure (especially on 3Com hardware), you just point all DHCP requests to a specific IP on your network, that IP being your DHCP server. If your using Windows Servers then just setup scopes for all the different VLAN's you have created. We scoped out or VLAN's like this: 192.168.2.x to 192.168.4.x - Bellis Building Level 1 192.168.5.x to 192.168.7.x - Bellis Building Level 2 ..... and so on. 192.168.2.1 and 192.168.5.1 are VLAN gateways... and so on. Edited January 21, 2009 by Zimmer 1
Theblacksheep Posted January 21, 2009 Posted January 21, 2009 with HP switches DHCP is handled by adding ip-helper X.X.X.X (x= ip address of DHCP server) to each vlan
artsaudi Posted January 21, 2009 Posted January 21, 2009 I haven't implemented VLANs on our network but we are on the process of doing it. Our first step was to change all our 3Com switches to more manageable switch like Cisco. And that was done this school year. Next year we will be buying a router which will route VLANs. It is in the router that you program the routing of the traffic to its right destinations. For example, if your DHCP server is on VLAN1, then all traffic for DHCP request from any other VLANs will be routed to VLAN1, where the server is. The DHCP broadcast will remain in VLAN1. I am not familiar on configuring cisco routers but i would be very glad if anybody can give some info also. Regards
Butuz Posted January 21, 2009 Posted January 21, 2009 Thanks for the reply. OK the scenario is this. Currently we have two physically seperate networks, a curriculum network and an admin network. The curriculum is in good nick with HP Procurve managed switches, The admin network is a state with a mix of Cisco switches and hubs, some of it is still on 10mbit. So what I wanted to do is use the curriculum network to host at least two vlans, one for the curriculum network, one for the admin network. So I can move both networks onto the same physical infrastructure, yet keep them seperate (to comply with LEAs outdated security) using vlans. This will kill a few birds with one stone 1) Curriculum and Admin networks still cant see eachother. 2) Admin network instantly gets upgraded to Gigiabit managed HP Procurve, for free. 3) Consolidating reduces the number of physical switches etc, this saving money on upgrades now, and in the future, and also saving electricity. Thats what I want to do. Using more than two vlans to segregate traffic on the network even further will be a bonus. Butuz Butuz. If you are keeping CC3, you cant re/build PCs that are in a VLAN without a DC. .
Butuz Posted January 21, 2009 Posted January 21, 2009 Have a look at these. ftp://ftp.hp.com/pub/networking/software/AdvTraff-Oct2005-59908853-Chap02-VLAN.pdf ftp://ftp.hp.com/pub/networking/software/AdvTraff-Oct2005-59908853-Chap03-GVRP.pdf Cheers - downloading and printing now! Butuz
spc-rocket Posted January 21, 2009 Posted January 21, 2009 Butuz. If you are keeping CC3, you cant re/build PCs that are in a VLAN without a DC. The RM solution is to put a DC in each VLAN, however you probably want all your servers in one VLAN (ours go in the Default_vlan) on the same as switches. Hmm i don't think this is actually true, we are running CC3 here and we have multiple vlans for various areas across the campus and all CC3 servers are in their own seperate VLANs. I think there are few things to the hosts file that needs to be changed in order to build stations on CC3 with VLANs but this is fairly simple to do. Ash.
dyoung5 Posted January 21, 2009 Posted January 21, 2009 Thanks for the information on the DHCP relaying. So its setup for each vlan on the router right? The main thing I wanted to find out from people is how it works with the LA/RBC WAN. We currently have 2 address ranges: admin: 172.16.30.0/24 curriculum: 172.16.112.0/22 and all our hosts run off that. When setting up VLANs, do you request a different subnet for each VLAN or some other way? Thanks, David
Zimmer Posted January 21, 2009 Posted January 21, 2009 If I'm reading your post correctly then no, you don't need different subnets for each VLAN. All your VLAN's can be on the same subnet or different subnets, it's up to you. Providing you have a device at each VLAN's gateway that can 'see' all the other VLAN's that has the ability to route traffic then you should be fine. If you want to have a VLAN that is totally 'blind' (unable to see any other VLAN's) simply don't create an interface on your gateway device. This way the VLAN's traffic it totally alone and effectively an independent network - This is good for creating development VLAN's for doing DR drills etc.
dyoung5 Posted January 21, 2009 Posted January 21, 2009 But surely you need different subnets so that the comptuers know to use the router interface when accessing hosts outside the subnets.
Theblacksheep Posted January 21, 2009 Posted January 21, 2009 (edited) Hmm i don't think this is actually true, we are running CC3 here and we have multiple vlans for various areas across the campus and all CC3 servers are in their own seperate VLANs. I think there are few things to the hosts file that needs to be changed in order to build stations on CC3 with VLANs but this is fairly simple to do. I'm going by an RM 'solution' for when we created VLANS. I'm sure there are ways around it, but RM directly didn't provide any. If you know the changes, i'd be interested!... as would RM! Edited January 21, 2009 by Theblacksheep
Zimmer Posted January 21, 2009 Posted January 21, 2009 (edited) That's why we designed our VLAN infrastructure around a 'core' device. The core switch is every networked devices default gateway, effectively the center of the physical network. Each VLAN has its own IP scope, and all VLAN's do share the same subnet. The core switch has an interface IP for each VLAN, this allows routing to take place between the VLAN's but prevents broadcast traffic from propagating to other VLAN's. If an interface IP address is removed for a specific VLAN then that VLAN will be unable to 'see' the rest of the network. Subnetting could be used, but it all depends on what your goal is with the use of implementing VLAN's on your network. Edited January 21, 2009 by Zimmer 1
TriggerHappyUK Posted January 21, 2009 Posted January 21, 2009 Has anyone done VLANs with L3 & L2 Netgear switches? Our school is full of them and we are attempting to VLAN in the summer. Chris.
Butuz Posted January 21, 2009 Posted January 21, 2009 This is all good stuff guys keep it coming! Butuz
k-strider Posted January 21, 2009 Posted January 21, 2009 We have L2 Netgear stuff and i too would like to look at segmenting the LAN into VLANs this summer or next anyone who has done this i'd appreciate some info too..
Zimmer Posted January 21, 2009 Posted January 21, 2009 Unfortunately I have no idea when it comes to Netgear hardware I'm afraid! However, as long as you have managed switches you should be fine for edge/workstation switching. For you server/core infrastructure you will need to have a switch or two that supports VLAN's and IP interfaces. In theory as long as your core switch is VLAN capable then you don't need any other specific hardware as long as your network is a star topology. You could create your VLAN's on the core switch, setup the interface IP's and then untag the ports you want to be a member of each VLAN. Because the ports are untagged then anything on the other end of that fibre or Cat5 will be a member of that VLAN. The ony downfall with doing that will be if in the future you need to create a tagged VLAN trunk from the core switch to a edge/workstation switch, then untag a port on the edge switch - Sorry if that didn't make sense! 1
k-strider Posted January 21, 2009 Posted January 21, 2009 Thanks Zimmer that does make Sense.. I have two Cabs that are joined together via a trunk now assuming both switches on that Trunk understand VLANS. on each of these "Core" swithes i have another dumb POE switch (for the Wifi) so it should be possible to Tag on the Core switches the uplink to the dumb POE Switches as being a particular VLAN then all the APs on each of the POE Switches would be part of the same VLAN... What would you call the method that the two Core switches use to know that say VLAN_2 is on the two dumb POE switches on port x on Core Switch 1 and port y on Core switch 2. Do you think the Two Core Switches need to be Layer 3 or Will Layer 2 ones do (they seem to support VLANS) and if so do you know what terminology i am looking for?
smadison Posted January 21, 2009 Posted January 21, 2009 We have six VLANS controled by one HP core switch. All staff laptops have a static IP with the ACL allowing staff onto the admin network from the curriculum and it works a dream. Our VLANS are on subnet 255.255.248.0 with the IP's as below: Curriculum 192.168.8.X to 192.168.15 Admin 192.168.16.X to 192.168.23.X Telephony 192.168.24.X to 192.168.31.X CCTV 192.168.32.X to 192.168.39.X Cashless vending 192.168.40.X to 192.168.47.X Building management systems 192.168.48.X to 192.168.55.X ACL's can be added as a range or by single IP's. the links to some of the docs i use have already been listed. Good Luck
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now