setting up vlans

[sted]

something ive never done but suspect could be usefull.

 

Now what im going to try and do (and will someone tell me if its a. stupid or b. not possible) is separate areas of the network so say pc in the suite cant ping/talk to pc in another room on wifi etc but if possible i want to keep my existing ip range for the sake of argument 192.168.1.x-192.168.4.x and use the same router ip for internet traffic.

 

my initial plan (unless someone shoots me down lol) is for 4 vlans

1 management so all the switches, servers, the router etc are on this and visable to all vlans

2 suite just the pcs in the ict suite

3 class other random hard wired pcs

4 wifi as its all the wifi is through a managed controller this shouldnt be hard

 

Ideally i want the main server to dhcp them all (it is in this case 2008r1 single nic hp g5 ml350 but there is an r2 box in school its just a hp microserver acting as wds/mdt/backup box) and tbh i dont care what pc in what vlan gets what ip if they need to be split so be it. Hopefully wds/mdt can be made to work o all vlans but if i have to tag/untag ports to make it work its not a deal breaker

 

the rasoning is something in the system is slowing the network down i suspect something somewhere has a dodgy nic/cable etc but everytime i look its fine so im hoping splitting the network will at least allow me to have some control and narrow it down and also there is no reason why 90% of pcs need to know about anything other than the servers

 

switches are all recentish managed hps in pretty much default config with spanning tree and igmp turned on

 

obviously im not going to do this straight onto the schools network as they have spare switches i was going to borrow them andset up a small test network. Im just not entirely sure where to start so any pointers before i just dive in and try things are appreciated

[glennda]

How many machines do you have?

[sted]

about 200 for round numbers

[glennda]

I would do as above but keep all machines on the same Vlan removing the suite won't make much difference - if anything use another for printers as they broadcast loads but depends on printer numbers

[6Foot2]

We have about 450 stations and we have VLans. Before the VLans were setup we had major traffic issues/slow network problems. After they were setup it was like we had a new network.

 

Wouldn't be without them now.

[sted]

thats what im trying to achieve lol

 

printers there are loads and most now are wireless sigh (aparantly staff cant walk to the copiers/shared printer locations so they all have their own and rather than mess round installing them locally i just added them to the server)

 

perhaps sepaating out the suite is overkill but its easy to test lol

[sonofsanta]

Way I've just done it here is to set all the VLANS up in the range "next door" so to speak, so that the original range is still alive and I can manage the migration at my own pace. Servers and switches are staying in this original range (VLAN1) and workstations are moving out, where VLANs are split up by the cabinet they're cabled from as it provides a more or less geographical breakdown.

 

DHCP wise, you need a separate scope set up for each, and tell the routing switch where the DHCP server is and to act as a DHCP relay.

 

Default gateway will need to be the layer 3 switch at your core (which will then have the internet gateway as its gateway) otherwise workstations in your new VLAN won't be able to see servers in the original VLAN.

[Mehmet]

something ive never done but suspect could be usefull.

the rasoning is something in the system is slowing the network down i suspect something somewhere has a dodgy nic/cable etc but everytime i look its fine so im hoping splitting the network will at least allow me to have some control and narrow it down and also there is no reason why 90% of pcs need to know about anything other than the servers

 

switches are all recentish managed hps in pretty much default config with spanning tree and igmp turned on

 

Although segmenting the network is a good idea, a 200 host network is quite small and therefore I wouldn't really expect there to be an issue with excess broadcasts.

 

Could you post up a diagram of your network, including the link speeds to all devices?

[sted]

Way I've just done it here is to set all the VLANS up in the range "next door" so to speak, so that the original range is still alive and I can manage the migration at my own pace. Servers and switches are staying in this original range (VLAN1) and workstations are moving out, where VLANs are split up by the cabinet they're cabled from as it provides a more or less geographical breakdown.

 

DHCP wise, you need a separate scope set up for each, and tell the routing switch where the DHCP server is and to act as a DHCP relay.

 

Default gateway will need to be the layer 3 switch at your core (which will then have the internet gateway as its gateway) otherwise workstations in your new VLAN won't be able to see servers in the original VLAN.

 

by cab is also doable but to a large extent would end up ks1 new build /ks2/suite ks1 old build

 

by layer 3 switch as default gateway i assume any switch capable of doing vlans is a layer 3 switch so i could use any switch that has a port open to the real router?

 

please excuse the crudity of the model its not done to scale

 

 

so

vlan 1 has ips of say 192.168.4.x gateway of 192.168.4.1 which is a switch in cab 2 which forwards to the real router

vlan 2 has ips of say 192.168.23.x gateway of 192.168.3.1 which is a switch in cab 2 which forwards to the real router

vlan 3 has ips of say 192.168.1/2.x gateway of 192.168.1.1 which is a switch in cab 2 which forwards to the real router

[sted]

diagram as current roughly

3 cabs all gb linked

cab 1 in newbuild 24+2 10/100(+2xgb)fibre to cab3 has ks1 pcs and main server

cab 2 is in suite full gb 24 port switch and 24+2 switch linked to cab 3 pcs wifi controller and wds/mdt server.

cab 3 fibre from cab 1 1 24+2 port and 1 48 port with gb pcs and server 3 (legacy 2003 dc for ye olde software)

[Mehmet]

by layer 3 switch as default gateway i assume any switch capable of doing vlans is a layer 3 switch so i could use any switch that has a port open to the real router?

r

 

You can create VLANs on a L2 switch, but you need a L3 device to do the interVLAN routing -- preferably a L3 switch.

[FragglePete]

Its something I'm trying to do here; it's taken a while to get my head around it all but I'm almost there. Biggest stumbling block now is needing an additional 'box' to do NAT-ing for any additional VLANs we put in place. We're on a set range from SWGfL, so the VLANs won't be able to get out through the gateway. To implement it I want something quite robust and simple in place but not really decided on the best option just yet. (TMG, Smoothwall, etc) - Budget is an issue as well.

 

Initial driver for us was putting a new VOIP phone system in place, and this was put on a seperate VLAN to help prioritise traffic and seperate it from the main network, but the phone system can't get out through the gateway due to lack of NAT-ing locally. It's not an issue for this system, but I do want to start breaking up the network but at the same time Keep It Simple!

 

Pete

[Mehmet]

Its something I'm trying to do here; it's taken a while to get my head around it all but I'm almost there. Biggest stumbling block now is needing an additional 'box' to do NAT-ing for any additional VLANs we put in place. We're on a set range from SWGfL, so the VLANs won't be able to get out through the gateway. To implement it I want something quite robust and simple in place but not really decided on the best option just yet. (TMG, Smoothwall, etc) - Budget is an issue as well.

Pete

 

Why do you need an additional box to do NAT?

 

How do your devices get onto the internet at the moment? Do you have an address range which is big enough for all of your devices? Are you allowed to use PAT?

[sonofsanta]

by layer 3 switch as default gateway i assume any switch capable of doing vlans is a layer 3 switch so i could use any switch that has a port open to the real router?

 

If your switches are all Layer 3 devices then you can just do the routing at that point, give all the workstations a default gateway of that VLAN's interface IP. Those layer 3 switches would then have a default gateway of the next hop along to the core, or a static route, so it knows where to pass it along.

 

Given the size of your network you could go the easier way of just doing all VLAN work at the Layer 3 core, and just do the tagging/untagging at the cab switches, not as sound technically as it means more traffic over your uplinks (prob. not significant for you) but also less work when setting up.

[teejay]

VLANs won't necessarily solve your problem, you are seeing the effects of a problem, ie network slowdown, without finding the cause of the problem. May I suggest before you do anything you invest some time with Wireshark and figure out what is causing the problem. Shout on here if you need help analysing:)

[FragglePete]

Why do you need an additional box to do NAT?

 

How do your devices get onto the internet at the moment? Do you have an address range which is big enough for all of your devices? Are you allowed to use PAT?

 

As said, set range given by SWGfL which is currently big enough for all devices which has a gateway address which will allow traffic only from that range. One option I guess would be to chop up said range, but would have to work out exact device numbers in each subnet. Not really sure on PAT if I'm allowed, tbh, not really thought of it. Main driver is to reduce the broadcast domains abit, and also introduce a public access Wi-Fi VLAN in the future.

 

Pete

[K.C.Leblanc]

, and also introduce a public access Wi-Fi VLAN in the future.

 

Pete

 

Depending on the system you use you might well need loads of IPs for this. Our system gives out an IP address as soon as someone connects to the guest SSID, on a 3 hour lease we've got 311 IP addresses in use. Most haven't even logged onto to use the system, they've probably just got their phones configured to automatically connect to any unsecured AP.

 

EDIT: What we've done is put guest clients into a separate vlan with a Forefront TNG server acting as a proxy. Only annoying thing is that you can't use TMG's transparent proxy function if you're connecting to an upstream squid proxy.

Edited May 1, 2012 by K.C.Leblanc

[Mehmet]

As said, set range given by SWGfL which is currently big enough for all devices which has a gateway address which will allow traffic only from that range. One option I guess would be to chop up said range, but would have to work out exact device numbers in each subnet. Not really sure on PAT if I'm allowed, tbh, not really thought of it. Main driver is to reduce the broadcast domains abit, and also introduce a public access Wi-Fi VLAN in the future.

 

Pete

 

I don't get it. The address block given to you is a public address block; they don't care about your private addressing scheme -- or do they? Obviously the NAT configuration would have to be altered to allow the new subnets to be translated -- is that a problem? If it is, then like you said you could subnet the private range you are currently using and it shouldn't be a problem (as long as your public address range is large enough).

[FragglePete]

I don't get it. The address block given to you is a public address block; they don't care about your private addressing scheme -- or do they? Obviously the NAT configuration would have to be altered to allow the new subnets to be translated -- is that a problem? If it is, then like you said you could subnet the private range you are currently using and it shouldn't be a problem (as long as your public address range is large enough).

 

It's not a public address block, its a private address range within SWGfL network that has it's own gateway that we use (we actually have two ranges, one for admin and one for curriculum but we only use the Curriculum range) - I don't have any control over the firewall, router, etc - just a range we have to use to be able to access the internet via the g/w address given. I can use an internal private range (and have done for the phone system), but will need to NAT from that range to the SWGfL range which I don't have the hardware for yet.

 

I think that makes sense?

 

Pete

[Mehmet]

It's not a public address block, its a private address range within SWGfL network that has it's own gateway that we use (we actually have two ranges, one for admin and one for curriculum but we only use the Curriculum range) - I don't have any control over the firewall, router, etc - just a range we have to use to be able to access the internet via the g/w address given. I can use an internal private range (and have done for the phone system), but will need to NAT from that range to the SWGfL range which I don't have the hardware for yet.

 

I think that makes sense?

 

Pete

 

Now I'm even more confused... "NAT from that range to the SWGfL range"? In that case, why not just use the range you have been provided with and subnet it?

[FragglePete]

Now I'm even more confused... "NAT from that range to the SWGfL range"? In that case, why not just use the range you have been provided with and subnet it?

 

That is also an option I'm looking at, breaking up the current range into smaller subnets. The range has 1024 IP addresses, but with hitting nearly 800 devices (when you take into account servers, printers, APs, desktops, laptops, projectors) squeezing those into logical subnets that keeps administration simple might be a challenge. But, yes, one plan is to "NAT from that range to the SWGfL range" but this requires some sort of NAT device which I don't have.

 

Thankfully the network is coping quite nicely being 'flat', but I know I can make it better by subnetting a bit more but careful planning is required.

 

Pete

[Mehmet]

That is also an option I'm looking at, breaking up the current range into smaller subnets. The range has 1024 IP addresses, but with hitting nearly 800 devices (when you take into account servers, printers, APs, desktops, laptops, projectors) squeezing those into logical subnets that keeps administration simple might be a challenge. But, yes, one plan is to "NAT from that range to the SWGfL range" but this requires some sort of NAT device which I don't have.

 

Thankfully the network is coping quite nicely being 'flat', but I know I can make it better by subnetting a bit more but careful planning is required.

 

Pete

 

Can I ask what private address range you have been assigned?

[FragglePete]

Can I ask what private address range you have been assigned?

 

PM sent!

[sparker]

Its something I'm trying to do here; it's taken a while to get my head around it all but I'm almost there. Biggest stumbling block now is needing an additional 'box' to do NAT-ing for any additional VLANs we put in place. We're on a set range from SWGfL, so the VLANs won't be able to get out through the gateway. To implement it I want something quite robust and simple in place but not really decided on the best option just yet. (TMG, Smoothwall, etc) - Budget is an issue as well.

 

Initial driver for us was putting a new VOIP phone system in place, and this was put on a seperate VLAN to help prioritise traffic and seperate it from the main network, but the phone system can't get out through the gateway due to lack of NAT-ing locally. It's not an issue for this system, but I do want to start breaking up the network but at the same time Keep It Simple!

 

Pete

 

We have been having a similar battle with SEGFL regarding NAT . It's not that they can't NAT on our cisco router - just that they won't and without it the telephone system has to route the call which uses up all of the phonesystems resources. They dont come with much as they are are supposed to be inly used for initiating the call ( as far as I understand it at least). Anyway I mention it only because there are three schools trying to do this with VOIP and you are now number 4 . If I get anywhere with it Ill update

[FragglePete]

We have been having a similar battle with SEGFL regarding NAT . It's not that they can't NAT on our cisco router - just that they won't and without it the telephone system has to route the call which uses up all of the phonesystems resources. They dont come with much as they are are supposed to be inly used for initiating the call ( as far as I understand it at least). Anyway I mention it only because there are three schools trying to do this with VOIP and you are now number 4 . If I get anywhere with it Ill update

 

Our Phone System doesn't use the Internet Connection for calls (SIP Trunks), we're using an ISDN30 for external access, just using our network infrastructure to deliver a phone in every room - I heard that SWGfL won't allow SIP trunks to across their network and some schools have gone down the route of getting a dedicated Broadband line for this.

 

Pete