HP 5406zl VLAN Setup Query

[Chuckster]

A few staff want to use their personal laptops to gain internet access in school. Our IP address range is 172.x.x.1 - 172.x.x.254 and the subnet mask is 255.255.255.0 and we have 2 x 5604zl switches.

 

How would I go about creating a VLAN so that when staff plug in their laptops they don't get any of our IP address range, or be able to see any of the network, but instead get a different IP address range with internet access only?

 

Can anyone help? I'm assuming a VLAN is needed for this.

[plexer]

In order ot be able to do it when they connect via wired ethernet I am guessing you'd probably need some form of nac enforcement, to enable this for wireless access then you would provide an alternative ssid that is part of a vlan.

 

Ben

[MYK-IT]

As plexer has mentioned a wireless provision with a separate SSID for personal laptops would be my preferred option (and easier if you had the correct kit of course) and is what we do ourselves.

 

With a hardwired route, unless you are going to allocate specific network points for the personal laptops, you would have to look into dynamic VLAN'ing. Whereby the device is initially authenticated (by RADIUS/NAC) and then that port is assigned to a specific VLAN for connectivity. (I've not done this, fixed VLANs here). This would also involve you configuring every other network switch accordingly (and assigning trunk ports - the ports that physically link each switch to one another). In turn you would have to create a DHCP scope based on your allocated IP address range, and also configure a DHCP IP Helper.

 

Alternatively, you may be able to use RADIUS/NAC to authenticate and (using ACL) only allow access to certain IP addresses (e.g. proxy server, internet gateway etc.)

 

Again, I’ve not used RADIUS/NAC, but I’m sure others have and will add to this.

[Chuckster]

Currently we have no wireless infrastructure in place so we have to resort to the hard wired route. Understandably I will need to create a new DHCP scope for this but this won't be an issue. That said, staff will only want to use their laptops in 3 designated rooms - staff room, library and another room assigned to teachers for their PPA time.

 

Once I have figured out which network points they will use and what ports they connect to in the switch, I will just need to set up a VLAN. Can a RADIUS/ISA/NAC be avoided if VLAN is used or would they both need to be configured?

[plexer]

Without nac what's to stop them just plugging their laptop into any old network point and getting access to your whole network and infecting it?

 

Ben

[maark]

If you have a vlan then you can setup access lists to isolate that vlan from the rest of the network so you would not radius etc.

[Chuckster]

Without nac what's to stop them just plugging their laptop into any old network point and getting access to your whole network and infecting it?

 

Ben

 

I have NAC enabled on my current scope so that only school brought laptops and desktops have access to the network. I even have a list of all the MAC addresses in the 'allow' list. Anyways, my query is to get personal laptops on the network with internet access only.

 

 

 

If you have a vlan then you can setup access lists to isolate that vlan from the rest of the network so you would not radius etc.

 

How would I go about instigating the whole set up of a VLAN? I can't find any guides that are simple to allow me to do this.

 

So far I have created a VLAN called "Guest" and then I just hit a brick wall.

[maark]

I used manuals from HP and searched on edugeek fourms.

Basically you create the vlans on your core switches (5604s) and create vlans with same number on other connected switches.

Make sure the ports that connect switches(uplinks) are tagged to that vlan on core and edge switaches. Then on the ports you want to force on to that vlan make them untagged. You have to configure gateway of vlan on core switch to match gateway in DHCP - also need to put ip-helper address on vlan via Cli command in telnet so that they can communicate with your dhcp server. When you can successfully get devices to pick up a ip address on the right scope and connect to internet then start thinking about access lists to restrict traffic.

[Chuckster]

Maark, do you still have those manuals?

 

Can I have a look an your config report?

[maark]

I have sent you a pm with config - you can get manuals by searching on HP and looking for chapters on vlans

HP 5400 zl Switch Series*-* HP Business Support Center

[Chuckster]

HI Maark, I never got the PM re config