Solved

When do I need a VLAN ID? I want to create 3 VLANs but not reconfigure current LAN.

Posted on 2011-02-24
14
496 Views
Last Modified: 2012-05-11
We currently have 2 networks but everything is on different hardware (firewall, switches, endpoints). What I would like to do is put everything on to the same equipment but VLAN it so each network is functioning as if it were on different physical hardware.

We have Dell switches and I have setup VLANs before. My confusion always comes when picking the VLAN type. Can someone provide some direction on this and I'm sure I will have more questions.
0
Comment
Question by:ThorinO
  • 7
  • 6
14 Comments
 
LVL 18

Expert Comment

by:jmeggers
Comment Utility
It may be slightly different between different platforms, but basic VLAN configuration on a Cisco switch port is to create the VLAN itself and then assign ports to that VLAN.   Most switches these days will create the VLAN automatically if you assign the switch port to a VLAN that doesn't exist.

interface gig1/0/1
switchport mode access
switchport access vlan 10

If you want the switch to route between VLANs, create a VLAN interface and assign it an IP address from the correct subnet.  If you want VLAN separation with no routing, don't create the VLAN interfaces.

interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shut

 
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
>My confusion always comes when picking the VLAN type.

Can you elaborate on what you mean by "type".
0
 
LVL 10

Author Comment

by:ThorinO
Comment Utility
Sorry, what I mean is that there is access, general and trunk. I have attached two basic images of what our current network looks like and what I am trying to get to. Basically we have a 40 port PoE switch that is being used as a WAN switch where an internet connection comes in and breaks off to two firewalls.

Current Network
We need to add more VoIP phones and I would like to just uplink the two switches (PBX) and keep adding phones. I would like to keep traffic separate so that the WAN ports and PBX ports don't communicate.  

Proposed Network
0
 
LVL 50

Accepted Solution

by:
Don Johnston earned 500 total points
Comment Utility
Okay. Now I get it.

You're not talking about VLAN types but port (or link) types.

An access port can carry only one VLAN. This is what would go to a PC.

A trunk port can carry multiple VLANs. This would be used between switches or from a switch to a server. They can also be used between a switch and a VoIP phone if the phone allows a PC to connect through it.

0
 
LVL 10

Author Comment

by:ThorinO
Comment Utility
So in my scenerio, Do I need to put the WAN ports in 1 VLAN, the PBX ports in another VLAN using access as the type?

What do I do about the uplink ports, do I just need to make them trunk ports?

So I need to create the same VLANs on the other switch 2 also even if they go unused (WAN) and add the PBX LAN ports to the same VLAN name as I used on switch 1?

0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 500 total points
Comment Utility
>Do I need to put the WAN ports in 1 VLAN, the PBX ports in another VLAN using access as the type?

You could do that. (although, best practice is to not use VLAN 1 for any user/data traffic)

>What do I do about the uplink ports, do I just need to make them trunk ports?

If the port needs to carry more than one VLAN, yes. Otherwise you could leave it as an access link. But to accommodate future possibilities, I would go with a trunk.

>So I need to create the same VLANs on the other switch 2 also even if they go unused (WAN) and add
>the PBX LAN ports to the same VLAN name as I used on switch 1?

The VLAN only has to exist if it's has to go through the switch. So for example let's say you've got three switches daisy chained together (with trunks):

Sw1 ----- Sw2 ----- Sw3.

Sw1 and Sw3 have ports in VLAN 66. In order for this VLAN 66 traffic to move from Sw1 to Sw3, VLAN 66 must exist on Sw2 (even though there are no ports in VLAN 66 on Sw2).

Now let's say that Sw1 and Sw2 have ports in VLAN 58. Obviously, VLAN 58 has to exist on Sw1 and Sw2, but it does not have to exist on Sw3 (it can, but it doesn't have to).


0
 
LVL 10

Author Comment

by:ThorinO
Comment Utility
You are saying I should leave VLAN 1 as default and make 2 for WAN and 3 for Phone and maybe 4 for data?

Do I only use numbers for VLANs or can I give them names to be more descriptive?

If I am going to do it right and just put the same VLANs on all the switches do I just need to make the uplink ports trunk or all ports trunk?

Our data LAN is 10.100.0.x, our PBX network is 192.168.0.x, and then we have ports 1-3 which are public. Do I need a L3 switch or router if I want to selectively allow traffic between the subnets?

For example, what if I want our data network 10.100.0.x to be able to connect to 192.168.0.5 on port 80?
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 500 total points
Comment Utility
>You are saying I should leave VLAN 1 as default and make 2 for WAN and 3 for Phone and maybe 4 for data?

Yep.

>Do I only use numbers for VLANs or can I give them names to be more descriptive?

VLAN ID are numerical. However, you can usually associate a name to the number.

>If I am going to do it right and just put the same VLANs on all the switches do I just need to make the uplink ports trunk or all ports trunk?

You don't have to make the inter-switch links trunks unless they will be carrying multiple VLANs. But I would make them trunks.

>Our data LAN is 10.100.0.x, our PBX network is 192.168.0.x, and then we have ports 1-3 which are public. Do I need a L3 switch or router if I want to selectively allow traffic between the subnets?

Either a router or a multilayer switch is required if you want to move any traffic between VLANs.

>For example, what if I want our data network 10.100.0.x to be able to connect to 192.168.0.5 on port 80?

You need a router or multilayer switch.
0
 
LVL 10

Author Comment

by:ThorinO
Comment Utility
Sorry for the delay on this one. A question I was thinking about yesterday/today.

I have all my data on 10.100.0.x and all my VoIP on 192.168.0.x. I would not have enough private IPs on one subnet for everything which means I need to break them down. Since that is the case, is the only way to communicate between the two by doing layer 3 switching or with a router?

Would a SonicWALL firewall be able to route traffic between the two?

If I do route between the two do I need VLANs?
0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 500 total points
Comment Utility
>is the only way to communicate between the two by doing layer 3 switching or with a router?
Yes

>Would a SonicWALL firewall be able to route traffic between the two?
Yes

>If I do route between the two do I need VLANs?
The term VLAN is synonymous with IP network. So if you have two networks, you do have two VLANs.
0
 
LVL 10

Author Comment

by:ThorinO
Comment Utility
I assume a Juniper SSG-140 would also route the same way a SonicWALL would. I am less familiar with our Juniper but I assume it has the same functionality.

So then with my current setup as pictured above. Could I just create a VLAN for the 3 WAN ports and leave everything else the same then have the Juniper/SonicWALL route traffic?

I would prefer not to get into VLAN tagging or L3 switching if possible and keep configuration and hardware as simple as possible.
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
>Could I just create a VLAN for the 3 WAN ports and leave everything else the same then have the Juniper/SonicWALL route traffic?

Without more detailed information on your network, it's hard to say for certain. But yes, that should work.
0
 
LVL 10

Author Comment

by:ThorinO
Comment Utility
So lets assume I had two networks on a SonicWALL, if I am on the 10 network and ping 192.168.0.25 for example the gateway assigned to my system (the SonicWALL) should route it correctly based upon firewall rules correct?
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
Once again, without more information as to the topology of the network (layer 2 and layer 3), I really can't say.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now