dezt Posted June 30, 2011 Posted June 30, 2011 Right then, i've finally got my new core switch, a HP Procurve E5406 zl, and it's a beast. I've been advised to split my network so that each building is on it's own VLAN. So it will be something like this. Default - Vlan 1 Servers - Vlan 2 ICT - Vlan 3 Technology - Vlan 4 Maths Block - Vlan 5 RSLA Block - Vlan 6 Science Block - Vlan 7 3 Storey Block - Vlan 8 CCTV - Vlan 9 Admin - Vlan 10 I don't know whether or not to put printers on a seperate Vlan, what would you think. Also, we are running a 10.68.x.x ip range, from reading some of the other posts on here i've come to the conclusion that i'll have to create subnets for each of my 10 Vlans, is this correct. I want to have all my Vlans routing on the switch through to the servers vlan for dhcp (so ip helper-address i think on all the other vlans). How would I go about setting this up? Would I create scopes for each subnet on my DHCP server so that they could assign ip addresses to the clients on each vlan? And this may sound a bit silly, but what ip address do I put in for each default gateway? Is it the ip address that gets assigned to the Vlan on the switch?
teejay Posted June 30, 2011 Posted June 30, 2011 Yes, add a printer VLAN, they are terrible culprits for broadcast traffic. Yes, split into subnets. You need to set a route up on the switch for each VLAN and set an IP address for the switch in each VLAN. In each VLAN you want to use DHCP you want to add an IP helper address pointing to your DHCP server. You also want to add an IP helper address to any server that you use for PXE boot such as a windows deployment server. On your DHCP server, yes set up seperate scopes. Have the default gateway as the IP address of the switch in that IP range. 2
dezt Posted June 30, 2011 Author Posted June 30, 2011 Thanks for that, can i just check one more thing, currently we have a subnet of 255.255.252.0 which has a masive range. This is set as one DHCP scope. If I create scopes for each Vlan on the DHCP server, do I then remove this current subnet and scope? Also, I read somewhere that you have to enter the subnets in AD sites and services, is this true?
dezt Posted June 30, 2011 Author Posted June 30, 2011 Oh, and I forgot to ask, do I put all my switches and wireless points on the default Vlan, which will be the management Vlan, or should I put all the wireless points on a Vlan of their own?
teejay Posted June 30, 2011 Posted June 30, 2011 Thanks for that, can i just check one more thing, currently we have a subnet of 255.255.252.0 which has a masive range. This is set as one DHCP scope. If I create scopes for each Vlan on the DHCP server, do I then remove this current subnet and scope? Yes, the easy way is to use a different private IP range if that's possible, especially if you're working on this with the network live. Also, I read somewhere that you have to enter the subnets in AD sites and services, is this true? Yes 2
teejay Posted June 30, 2011 Posted June 30, 2011 Oh, and I forgot to ask, do I put all my switches and wireless points on the default Vlan, which will be the management Vlan, or should I put all the wireless points on a Vlan of their own? Stick your wireless points on their own VLAN. It's also recommended by HP for better security to put the management interface of the switches on their own VLAN, but that can be a pita. To give you a rough idea of how to set up a VLAN from the command line on the switch: vlan 2 name "Servers" untagged E1-E5 tagged A1 ip helper-address 1.2.3.4 ip address 10.0.0.1 255.255.255.0 ip igmp ip rip 10.0.0.1 exit
dezt Posted June 30, 2011 Author Posted June 30, 2011 I think what i'll do is get everything setup on a test server running DHCP in a test enviornment, and then when everything is woking fine I can implement it during the summer holidays. The Admin Vlan will be getting it's DHCP lease from a different range, 10.120.x.x, which is what we have been allocated for our admin domain, so i'm thinking that I would leave that domain as it is for the time being, with the server being a member of the 2 vlans we currently have, curric and admin, so it can send DHCP via it's 10.120.x.x address to admin clients and also allow SIMS to be used by curric clients. It works that way at the moment, with no routing in place on the current core, would that just be the same, or would I be better off setting up ip helper address for the admin vlan to point to the 10.120.x.x adaptor in the admin dc.
teejay Posted June 30, 2011 Posted June 30, 2011 Leave it as it is, it's more secure, unless of course you want to start messing with Access Control Lists on the switches, which you may want to do anyway to prevent traffic routing between client VLANS.
dezt Posted June 30, 2011 Author Posted June 30, 2011 So if i'm right, this would be how I would do it for my server vlan for 10 servers vlan 2 name "Servers" untagged A2-A11 tagged A1 ip helper-address 10.68.x.x ip address 10.68.x.x 255.255.255.240 ip igmp ip rip 10.68.x.x exit What are the ip igmp and ip rip commands for?
teejay Posted June 30, 2011 Posted June 30, 2011 Yep, that's about right, the ip helper address wants to point to the ip address of your DHCP server, the ip address wants to be an address within the range you have assigned to that VLAN (I tend to use the first IP address in the range) and the ip rip address should be the ip address you've set in the ip address line. The ip rip command enables routing in the vlan and igmp enables multicasting, prob won't need that. 2
dezt Posted June 30, 2011 Author Posted June 30, 2011 How do I set a route to my normal default gateway to allow internet access? my usual default gateway is 10.68.40.1 Once I know how to do this I should be good to go.
teejay Posted June 30, 2011 Posted June 30, 2011 without being in a VLAN config: ip routing (this will enable routing on th eswitch) ip route 0.0.0.0 0.0.0.0 10.68.40.1 (this adds your default gateway as the default route) 1
dezt Posted July 1, 2011 Author Posted July 1, 2011 Just wondering, how would I manage my switches? Would I route from the server Vlan to the Management Vlan (or Default Vlan), as they are on different subnets. I'm guessing I would.
gshaw Posted July 4, 2011 Posted July 4, 2011 I've not seen that ip rip command before in the HP VLAN configs, is it required on every VLAN definition?
teejay Posted July 4, 2011 Posted July 4, 2011 I've not seen that ip rip command before in the HP VLAN configs, is it required on every VLAN definition? If you want routing enabled in the VLAN, yes. It's only needed on the switch doing the routing though. 1
gshaw Posted July 4, 2011 Posted July 4, 2011 (edited) That's very handy to know, so I can enable \ disable routing on a per-VLAN basis which is good for vMotion traffic and the like Just to check I'm not crossing wires, when you say routing in the VLAN is that routing between that VLAN and the others on the switch on the other subnets or another level of routing on top just related to that particular VLAN? Edited July 4, 2011 by gshaw
dezt Posted August 10, 2011 Author Posted August 10, 2011 I think i'm having a nightmare, got all the routing set up, except for one ip helper address, I typed in the wrong address, is there a way to change the address without deleting the vlan and recreating it? Nightmare is my 3com edge switches, baseline 2226+ wont allow the HP switch vlan's through them. I suppose they are 7 years old now though. I've got to buy some HP switches for using st the edge now, hope the SBM understands that I had no idea that this was going to happen, I think we need about 5 new 24 port switches. Until the new edge switches are in place and configured, I won't be able to change the DHCP scopes as people keep coming in and moaning if they can't use computers, so much for school holidays = no teachers, i've seen more than I do during a normal term. Just to top things off the SBM is off till the end of this week, then i'm off till the end of next week, then it's make sure everything is working for results week, then somehow build a new website for the school in a week, when exactly am I supposed to fit in the switch configuration, if i'm allowed to buy them?
nicklec Posted August 10, 2011 Posted August 10, 2011 no need to redo the entire vlan config, just enter "no ip helper-address" then redo the set command (same for alot of procurve commands). 1
mrbios Posted August 10, 2011 Posted August 10, 2011 If you're on the 10.x.x.x range can i assume that's the range supplied to you by your local government ISP? If that's the case set yourself up an ISA/TMG server, block yourself off from them completely and give yourself an internal range of 172.x.x.x for example. One thing i found without being well seperated from the ISP provided range was the ease at which you could access other schools networks (especially using hp procurve manager, i could see all the local schools switches!!) Moved away from the ISP provided 10.7.x.x range years ago and would never look back. (can't garuntee i explained that correctly, i had a shed load of help on that bit and it was about 5 years ago now)
IanT Posted August 10, 2011 Posted August 10, 2011 as above, just plum the command in no ip helper-address, wr mem done!
nicklec Posted August 11, 2011 Posted August 11, 2011 If you're on the 10.x.x.x range can i assume that's the range supplied to you by your local government ISP? If that's the case set yourself up an ISA/TMG server, block yourself off from them completely and give yourself an internal range of 172.x.x.x for example. One thing i found without being well seperated from the ISP provided range was the ease at which you could access other schools networks (especially using hp procurve manager, i could see all the local schools switches!!) Moved away from the ISP provided 10.7.x.x range years ago and would never look back. (can't garuntee i explained that correctly, i had a shed load of help on that bit and it was about 5 years ago now) "LGfL 2.0" requires you to not run a firewall/NAT as the source IP lets you have per-user filtering etc. We get a /21 subnet too which should be plenty!
Soulfish Posted August 11, 2011 Posted August 11, 2011 "LGfL 2.0" requires you to not run a firewall/NAT as the source IP lets you have per-user filtering etc. We get a /21 subnet too which should be plenty! You can still run NAT and your own firewall with LGfL 2.0 - I know we do and I've been speaking with their network guys at Atomwide about things making sure everything works correctly. All that they want to make your aware of is the fact that their filtering system won't work correctly if you do so, and neither will the other features and functions they provide without some work arounds. For us it isn't too much of an issue as we have our own internal filtering (Smoothwall), but the RAV3 service is quite nice but you just have to set up some form of static NAT from the LGfL range to your internal range .
ChrisH Posted August 11, 2011 Posted August 11, 2011 If you want routing enabled in the VLAN, yes. It's only needed on the switch doing the routing though. My 5406 routes without that in the configuration.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now