We help IT Professionals succeed at work.

Easiest way of implementing VLANs

Medium Priority
Last Modified: 2012-05-07
I have a big LAN of almost 500 users, in a building of 3 levels, and I have 15 servers (MS-AD, DNS, applications ,etc) every network device  is  in the same  VLAN (1) the default. I have  cisco switches  2950 for edge switches and  a CISCO 4507 for core switch. Now I have network problems , regarding to  many broadcastings  problems, retransmissions, etc, With all these problems I have been advised to implement VLANS  in order to limit the  broadcastings,,but  I would like help  for  finding  the best way for implementing VLANS,, I just want to segment the  Servers,, and  each IDF of each floor. I don't need to segment per users, or per applications just for avoiding broacstings.
I attach a diagram for better understanding.
Watch Question

Please read this post till the very end before taking your network down. I assume that you have good knowledge about your current infrastructure, applications, IP addresses. Please ask all Q before actual migration. I also assume, that all workstations are using DHCP, otherwise it would be pain to migrate. However, if all PCs have static addresses, you will just need additional task force to reconfigure all PC's to use DHCP.

I would suggest the following migration scheme.

you create additional vlans on all switches for example:
vlan 2 - servers, created on the nearest switch to the servers and on a core 4507
vlan 3 - IDF 1, created on IDF 1 and core 4507
vlan 4 - IDF 2, created on IDF 2 and core 4507

Next thing to do - interconnect all remote vlans to core switch. to do this you need out of business time (I would suggest friday evening, so you will have time to implement new topology until monday morning) and possibly console access to switches.
you logon to IDF 1 switch and configure uplink port (let it be gi0/1) as tagged with 2 vlans current default and a new one vlan3 (for IDF 1)
configure terminal
int gi0/1
desc to_4507
switchport trunk allowed vlans 1,3
switchport mode trunk

at this point (if you were reaching IDF switch via 4507) your connection will be lost. Don't worry about that. so you perform the same task on 4507 for a port to IDF 1 switch.
configure terminal
int gi1/1
desc to_IDF1
switchport trunk allowed vlans 1,3
switchport mode trunk

now you should regain connectivity to IDF 1 switch.

In the same way you proceed with other IDFs.

Now you should be plan your IP topology carefully. Each vlan will have it's own IP subnet, so you have to configure your dhcp server (let it has IP of with additional scopes.
Let's assume you are going to implement the following IP scheme (we are not interested in your current one, because you will migrate all PCs step by step to a new topology) - servers vlan 2 - IDF 1 - IDF 2 - IDF 3 - etc

Sure thing 4507 should be a default gw for ALL vlans within your network and should also know where dhcp server is for each vlan:
configure terminal
int vlan2
name servers
ip address
int vlan3
name IDF1
ip address
ip helper-address
int vlan4
name IDF2
ip address
ip helper-address
int vlan5
name IDF3
ip address
ip helper-address

Firewall should be placed in additional vlan and switch shoud have it's default gw configured to firewall.
int vlan100
name fw_vlan
ip address
int gi1/10
desc firewall
switchport access vlan 100
ip route ---- address of firewall

Firewall should be reconfigured to a new IP address and should also allow all your subnets to internet (if needed)
At this point you are ready to reconfigure servers with new IP addresses and place then into correct vlans.
conf  term
int gi1/2
desc dhcp_server
switchport access vlan 2

All servers shoud be rebooted after that, because they should reregister them selves in DNS.

At this point you shoud have fully functional infrastructure - servers are separated, they should be accessible from workstations (workstations should have 4507 as a default gw). If not, try to troubleshoot problems.

Only after this step you should move to the next step - moving PCs to new vlans.
To do that - move all ports on IDF1 switch to vlan 3 and reboot all PC in that switch in order to them to get new IP addresses.
Check: PCs in IDF1 should be able to get new IP with default gw, with access to internet, to servers.
If everything is ok - proceed to the next IDF.

Uff... Seems that is all.
Kamran ArshadIT Associate


Please find attached the VLAN design template.
VLAN is a way of micro-segmenting a L2 / L3 topology into separate broadcast domains. Each VLAN is a separate broadcast domain, ie: all broadcasts are seen by devices within the same VLAN.
Inter-VLAN communication is restricted, requires a L3 routing device to communicate between broadcast domains.  
Couple of Benefits listed below
1. Saves excessive usage of physical connectivity
2. One link can pass all different broadcast seggregated packets to respective destinations
3. By using VTP further, we can also sync between devices making one as server and other clients. Updates will be sent automatically and devices will remain in sync upon any change recorded amongst them.
4. Different Vlans can be segmented across different deppt. for eg marketing and sales in the same building can be put under  tow seperate vlans. Both networks will remain seperate though using the same devices to flow.
5. Bandwidth is saved a lot as well. Further you can use etherchannels to segment the bandwidth for better flow of packets. 
Given the number of PC's you have, separation by device class just won't yield much of a result - your broadcast domain will still be equally flooded.
I'd recommend a mix of the two methodology. For example, lets take the subnet and let us use the second octet for site, the third octet for vlan-id and the fourth as the host octet.
Site 1: 10.1.v.h
Finance: v = 20
HR: v = 25
IT: v = 20
Switches/routers: v = 1
WAP's: v = 4, h = 200-254
Wireless clients: v = 4, h = 10-199
Printers: v = 5
Phones: v = 6
Management: v = 100
Yes, that is a lot of address wastage but you get the idea. Generally we want to keep as much broadcast data into a single vlan as possible. If departmental devices can be on the same physical access layer device then that combined with dedicated vlan would be better again.

Open in new window

Apolo VictoresIT Infrastructure Supervisor and Networking Sp.3M


Thanks for your solutions!, I will certainly do what you are recommending,, I missed to tell  you that I have 12 accesspoints  for wireless users,, and  a TCPIP  subnet of  1022  host (22 subnet bits) ,, (179.7.X.X/ ,, and  the question would be,, Do I need to assign separated ip subnets for each  VLAN? ,, or How Can I manage those IPs  in the  DHCP server?


Yepp, you need separate IP subnet per vlan. You can manage DHCP scopes on DHCP server. Client in each vlan will get its lease from a correct pool for that vlan.
However you can consider if you need every IDF in its own vlan. Possibly you can group them according to departments.
Unlock this solution and get a sample of our free trial.
(No credit card required)
Apolo VictoresIT Infrastructure Supervisor and Networking Sp.3M


Thank you for your solution!,,it is really complete a accurate!
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.