VLAN for Dummies?

[Sylv3r]

We got a lot of our information from the HP support forums when we started off looking at VLAN's. They are a lot of knowledgeable people on their (not unlike this forum) that give us a hand with the config as soon as we posted what we had and what we wanted to achieve.

 

IT Resource Center forums

[HMCTech]

Please make sure that all your wall sockets are numbered correctly to the patch panel, so you can easily tell what port on a switch a device is plugged into. If I had a pound for every time I have had to go through the process of looking in a MAC table on a switch to find what port the host is on I would not need to work.

 

Apart from that VLAN is quite interesting to set up and quite easy to maintain, if anyone needs screenshots of DHCP or of a switch set up let me know ill see what I can do.

 

Also I see that alot of people are suggesting 192.168. addresses. We use 10.x as our VLANS and it makes it very easy to ID which VLAN a machine is on and what it should be on. 10.1 is default 10.3 & 10.4 are staff, 10.5 & 10.6 are pupil and 10.10 are admin.

Edited January 22, 2009 by HMCTech

[andyrite]

We have L2 netgear edge switches here.(FSM750S) They support vlan tagging.

[Theblacksheep]

If I had a pound for every time I have had to go through the process of looking in a MAC table on a switch to find what port the host is on I would not need to work.

 

If people have HP switches and procurve manager on a central PC can do a mac address lookup and it'll tell you what switch and what port the mac is connected to from one area.

 

If I had a pound for every time i've needed to find a PC on one of the switches, it would have paid for procurve manager several times over.

[Hawkeyez]

The school are going down the route of a Cisco VOIP solution, and the provider is wanting a VLAN, but cant help, as our switches is mostly 3Com.

We are also a CC3 school, so would ideally keep the default VLAN for the curriculum network, but add an additional VLAN for the VOIP. The cabling in the school, will allow the actual infastructure to be kept apart upto the Core switches (3 x 3Com 5500 in each building, connected via fibre)

I am buying a number of Cisco PoE switches from them, as the 3Com ones we have can be a bit tempremental at times, and require a power-cycle. And so they all should uplink only onto the 3Com 5500G switches.

 

Anyone got any suggestions?

[nicholab]

The basic principal of a vlan is that you are separating traffic on to different sub-nets this in turn mean that to transverse sub-nets traffic has to be routed.

[sidewinder]

The one thing I dont quite get about VLAN's is how do you make sure each machine is connected to the correct VLAN? Do you have certain ports on each switch or is there some way of automatically assigning it?

Because we have 30+ switches with different numbers of staff/student machines in each area and doing it manually would be an absolute nightmare

[ChrisH]

The machines are on the vlan of the port they are plugged into. It's the uplinks from the switches you have to worry about. If you want them on more than 1 VLAN then it gets more complicated.

[sidewinder]

So I'm right in thinking it would be a nightmare then! In a good majority of our cabs we would need switches on more than 1 VLAN

[dmakinson]

We are currently creating vlans across our site. We have acc3 network and are having difficulty rebuildng PC across the new subnets. I understand from SPC-Rocket that you can make changes to the CC3 DC lmhosts file to solve this.

Any instructions would be greatly apprecialted!

[dmakinson]

Oh and has anybody had any issues with wireless roaming across subnets.

[m25man]

VLans, an interesting subject...

 

We use VLans to create several separate virtual networks that utilise the same physical cabling (subject to bandwidth availability).

 

We run 8 VLans some cabs have dedicated switches, some switches have several grouped ports.

I might have a 24 + 2 switch, 6 ports untagged VL10 data, 6 ports untagged VL20 voice, 6 ports untagged VL30 epos, 6 ports untagged VL40 CCTV.

 

Fibre uplinks all tagged with all VLans

 

Each VLan has it's own IP range, for simplicity this matches the VLID so 192.168.10.0 = VL10 etc etc

Each VLan uses colour coded patch cords, VL10=Yellow VL20=Blue etc etc.. This helps to simplify port management.

 

Some desktops will carry both data and voice on a single port which requires the port to be tagged with both VLans.

The core L3 switch routes between VLans if we wanted it to however we use our Sonicwall NSA's to this as this gives total control right down to packet level filtering between segments which is essential when you need to conform to PCI-DSS requirements which in this case includes payment cardholder traffic across common uplinks to payment gateways.

 

This particular model is by no means defacto, it just works for what we need it to do.

 

The real secret to good VLans is good documentation.....

It's the only way to avert a serious problem down the line if you want to play with VLans.

Use the coloured patch cords so that you can just look at your cabinets an know immediately which port belongs to what VLan.

 

Use your switches web or CLI interface to print a table of the switches VLan config and keep it in the cabinet.

 

Hope that gives you another view of the diverse ways you can use VLans.

[Butuz]

Just thought I would update this thread to say that I did get VLANS working in the end on my HP Procurve Kit mostly thanks to the info and links on this thread!!!

 

I've gone for a relatively simple set up to start with. Split the network into three VLANS:

 

1. Curriculum (default vlan)

2. Admin (admin/sims network)

3. SAN (Sun Storage for VM's / virtualisation)

 

Touch wood seems to be working good!!

 

I am looking at expanding it further to have separate VLANs for our catering system and our teacher PCs but am not 100% sure about this as my core switch is only a Layer 2 not sure if I can get the required routing working on that switch. More research needed!! (or a HP Procurve course!!!)

 

Butuz

[ChrisH]

You will need a layer 3 switch to do the routing. Currently setting ours up.

[Butuz]

I suspected that. Shame. Will have to wait until 2012 for whole network upgrade.

 

Butuz

[m25man]

You can route between your L2 VLans of course by using a Router, a cheap cable device or a home brew PC with 2 NICs will do.

It will get you by until you can afford a decent core switch!

[m25man]

The machines are on the vlan of the port they are plugged into. It's the uplinks from the switches you have to worry about. If you want them on more than 1 VLAN then it gets more complicated.

 

It doesn't have to be, thats what the GARP Protocol is for. Multiple Registration Protocol - Wikipedia, the free encyclopedia

 

If a VLAN is associated with a specific subnet then the equipment when plugged into the port will inherit that VLAN ID

In the case of a PC and an IP Telephone that may share the same switch port (IP phones often have an in/out RJ45 in them) the switch would have both VLan ID's assigned to it.

You can also put the VLAN ID's into the hardware or drivers of the PC this way they can use GARP by letting the switch know which VLAN they want to use.

On our phones you program the VLAN ID into the handset it reboots, gets a DHCP IP address from the Telephone system via VLAN ID 3 on one subnet whilst the PC using the same data outlet gets its IP from the Data network DHCP server. The Tagging sorts it all out.

[featured_spectre]

We currently have 2 address ranges:

admin: 10.9.25.x/24

curriculum: 10.11.48.x/22

and all our hosts run off that.

 

I have set my VLANs to run on different subnets and set the servers to those subnets also, that way, I am ensuring that the children can never get the staff network access...which is a bonus!

[ChrisH]

It doesn't have to be, thats what the GARP Protocol is for. Multiple Registration Protocol - Wikipedia, the free encyclopedia

 

If a VLAN is associated with a specific subnet then the equipment when plugged into the port will inherit that VLAN ID

In the case of a PC and an IP Telephone that may share the same switch port (IP phones often have an in/out RJ45 in them) the switch would have both VLan ID's assigned to it.

You can also put the VLAN ID's into the hardware or drivers of the PC this way they can use GARP by letting the switch know which VLAN they want to use.

On our phones you program the VLAN ID into the handset it reboots, gets a DHCP IP address from the Telephone system via VLAN ID 3 on one subnet whilst the PC using the same data outlet gets its IP from the Data network DHCP server. The Tagging sorts it all out.

 

For the sake of completeness it would only be fair to mention that not all devices will support this.

[jimmy_2k]

Hi all, at my previous place we used MAC address based VLANs with Cisco VMPS. Basically you entered the MAC address of a device into the desired VLAN and wheverever you plugged it in it would find itself, this is also good for security as only the devices you approve can be put onto the network, this is also good if you want to flood wire a building and add devices remotley etc. My current place has been configured with port based VLANs, so each switch as above has ports mapped for various device VLANS, wireless APs, workstations, servers etc. When I get some time I'd like to do the CCENT qualification at least to be able to replan this setup as I'd like to make changes to mine eventually. We also have our Class A ip address (ones starting 10.xx.xxx.xxx) provided by the LA as we are all part of the council WAN at the end of the day so devices need to be seen within that network.