Cisco VLAN's Best Practices Question

I am looking for document or information on the best practices of configuring VLANs.

Specifically, I have a need for two VLANs, one that is for general usage in the office (let's say VLAN1), and a second that is internet usage only (cannot access any servers or other devices) (VLAN2). Both Vlan1 and Vlan2 need to go through the same router to access the internet.

My first question, is how to handle DHCP; do most companies implement a second DHCP server for the seperate Vlan, or is there a way to have a DHCP server provide service to both Vlans. Of course, I only want VLAN2 to be able to see the DHCP services on the DHCP server, all other ports should be blocked.

I have two Cisco 3560's, a Pix 506E, and a 1100 Series AP; DHCP comes from a 2003 server.

Any links to best practices, or VLANing theory would be appriciated.

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Les MooreSr. Systems EngineerCommented:
Here you go:

>how to handle DHCP
You can use one server with 2 scopes to service both vlans, or you can have the 3560 switch be the DHCP server for both vlans, or you can have the PIX506 be the DHCP server for both vlans, or any combination thereof..

If you use either the switch or the PIX, vlan2 simply can't see vlan1 or needs access to the server..
The 506 will only support 2 vlans and is very simple to set up:

interface ethernet1 vlan2 logical
nameif vlan2 intf2 security50
ip address vlan2
nat (vlan2) 1 0 0

The switcport to PIX interface must be a trunk port (they are auto by default).

Switch example create a new vlan2 and assign ports 14-24 to that vlan:
switch#vlan data
switch(vlan)#vlan 2 name internet
Apply completed
switch#config term
switch(config)#interface fast 0/1
switch(config-if)#descript PIX Firewall
switch(config-if)#switchport mode trunk
switch(config)#interface fast 0/2
switch(config-if)#descript AP1100
switch(config-if)#switchport mode trunk
switch(config-if)#interface range fast 0/14 - 24
switch(config-if)#switchport access vlan 2
switch#sho vlan

I'm assuming that you will also have both public and private SSID's / vlans on your Wireless AP, too?


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
1 - How you address DHCP is put ip-helpers on each vlan pointing to your DHCP server

int vlan 12
ip-helper-address IP

By default this forwards all the below listed services to the machine listed as the helper address

Service Port
Time 37
DNS 53
BOOTP/DHCP Server  67
 BOOTP/DHCP Client  68
 TFTP  69
 NetBIOS name service 137
 NetBIOS datagram service  138

2 -when you create your vlans do not use vlan1 as this is the default which all the ports will belong to

Documentation creating and maintaining VLANs it describes a number of things such as VTP etc.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.