[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

VLAN setup between 4 HP Procurve 2810-48G's

Posted on 2011-05-11
14
Medium Priority
?
1,683 Views
Last Modified: 2012-08-13
Hello experts. I want to setup a VLAN architecture to avoid broadcast traffic happening from one switch to another switch. We currently have 4 HP Procurve 2810-48G switches which have only a default VLAN setup, but I believe the broadcast traffic can be significantly reduced by VLANing each switch to the others.

So, without knowing a lot about the process of VLANing and only having read technical documents about the pros and cons, can someone tell me the basic setup I would need to consider along with the "gotchas" involved in simply making sure that any broadcast traffic on switch 1 won't be broadcast on switches 2-4 and vice versa for all switches involved?

We are on a subnet of 10.10.0.0/16 for all local traffic.

Thanks in advance for any help, thoughts or considerations in helping me.
0
Comment
Question by:swcrook
  • 6
  • 4
  • 3
  • +1
14 Comments
 
LVL 12

Expert Comment

by:Fidelius
ID: 35739233
Hello,

To use VLANs to limit broadcast you will need to subnet your network.
1 subnet -> 1VLAN
You will also need router or L3 switch for inter-vlan routing.
0
 
LVL 47

Expert Comment

by:Craig Beck
ID: 35739255
You would need to reconfigure the IP address on all of your devices.  How many devices do you have?
0
 

Author Comment

by:swcrook
ID: 35739450
I have 4 devices. They each have a 10.10.1.x IP. We have a router connected to all the devices in the same ER.
0
New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

 
LVL 29

Expert Comment

by:pwindell
ID: 35739520
Well your IP Segment is horrible oversized.  I really doubt you have 65,534 Hosts on your LAN.  You should never a mask of lower bits than /24 unless you are supernetting a Backbone.  But anyway,...on to what you asked......

Broadcast don't "happen from one switch to another" in the way you are stating that.   Broadcasts simply stretch across the Broadcast Domain (L3 Segment) which is exactly what you want them to do and exactly what they are intended for.

Now we can actually discuss the same concept and never once use the word "VLAN",...in fact if I read the word VLAN on more time I may throw up (just kidding),...but if you read day after day here in these forums at all the ways VLANs are misused, abused, misunderstood, misinterpreted, and over-engineered, you'd feel the same way.

The real question here is broadcasts,...and what to do about them.   Are Broadcasts bad?,..no,..they are good,..networks cannot function without them,...but too many broadcasts are bad.  How do you know if you have too many?  Well there is a simple General Rule:

On a IP Segment where most OS's are Windows,...for every 200 machines break off a new subnet.  Subnets should be 254 Host (/24bit) segments.  If most OS's are Linux/Unix you can push it into the 300's but there is no way to create an IP Subnet that size (it jumps from 254 straight to 510).  So even with them just follow the same /24bit model.

However it is quite possible that you may run some specific custom applications that generate a huge amount of broadcasts (maybe due to bad programming and lazy developers).  This could justify a smaller IP Segment just to isolate that,..like maybe a /25bit (128Host) or a /26bit (64Host segment).   We are a TV Station, and as an example, the new Automation and Video Playout System we are adding in generates a lot of broadcast and so I have it on it's own separate /24bit segment.

The Procurve 2810:
I don't think that one is L3,...only L2.  That means it is only a Switch,...not a Router,...so you are screwed,...you have to have a Router to route between L3 IP Segments.   But if it were an L3 capable Switch/Router Combo then you would create one more VLAN (VLAN2) on the device and then enable "Routing" on the device so that it becomes a "router".  Then you create a "router interface" by assigning some of the Switch ports to each VLAN.  For example you can take the first half of your ports and set them to Untagged on VLAN1 (the Default VLAN) and set the second half of the switch ports to VLAN2 as Untagged.  

You now have a LAN Router with two IP#s on different IP Segments, one on each newly created Router Interface (notice I could describe that without calling it a VLAN).  But,....whoops!!,...now the LAN's Topology has changed!!  So now the LAN Router (notice I call the Switch a router,..because that is what it is now) becomes the Default Gateway of the entire LAN with all Hosts on the LAN using the Router Interface that directly faces them as their Default Gateway.  Your outbound gateway (Firewall?) now becomes the Default Gateway of the LAN Router (yep, still calling it a router now).

Whoops!!!!,...the outbound Gateway (your Firewall) doesn't work correctly with the new IP Segment.  That's right,..it won't,..so you have to add the new IP Range to the Firewall's Local Address Table and you will also have to add a static route on the firewall that tells it to use the LAN Router (yep, still calling the Procurve switch a router now) as the proper "gateway" to get to the rest of the LAN

Well I hope that clarifies some things,...or at least makes you realize how BIG the question you are asking really becomes and hopefully helps you realize if this is even something you need to pursue in the first place.

Also notice that except for the paragraph about the individual config within the Procurve Switch I never used the word "VLAN",...I used,....router,....router interface,....gateway,...and IP Segment,...so I don't have to throw up now  (yea, just having a little fun with that one).
0
 
LVL 29

Expert Comment

by:pwindell
ID: 35739589
I have 4 devices.

On the entire LAN!?!?

They each have a 10.10.1.x IP. We have a router connected to all the devices in the same ER.

What does that mean?  ER? (Emergency Room?)
Router?,....you mean a "Firewall"?,...and NAT Device?,...those are not "routers", they don't route anything and can't be used as a LAN Router to save it's life.  Yea,..I know they call them routers on the retail store shelves,..but they are not real routers.
0
 

Author Comment

by:swcrook
ID: 35739937
Okay, well, thanks for the information. Yes, I used ER as equipment room, and if I am not to refer to a virtual LAN as vlan then I am at a lose as to what to refer to them as. I understand your reasoning as to why the term "vlan" can be used improperly, but since I am specifically asking about vlans I am not sure how that would be used improperly in what I asked.

However, I do see that I was not very specific in my questioning as I am indeed wanting to limit excessive broadcasts across the L3 by possibly using VLANs; hence, asking the experts here for advice.

Secondly, the first thing I noticed upon working here is the /16 mask. Now, the reasoning behind that is simply that we have branch locations which use 10.10.1.x, 10.10.2.x, 10.10.3.x, etc on down the long until we reach the 100+ plus stores we have. Again, not my design but it is what it is and it is what I have to work with.

And you are probably bordering on being wrong about my "router" but I dont want to make assumptions here. We have a Fortinet 200B device which does indeed operate as router, firewall and natting device all in one. It does route packets as a L3 device and it also provides switching capabilities as well on the L2 layer.

Sorry, I read the question about how many devices we have and as such I simply applied that question to the switching devices I am referring to. I now believe this was a question about how many nodes/devices would need to be confiigured once VLANing were in place (beyween the switches and the router).

I hope it is nice outside where you are as you could use some fresh air for those dry heaves you are having :P
0
 

Author Comment

by:swcrook
ID: 35739952
down the line*, not long
0
 
LVL 29

Expert Comment

by:pwindell
ID: 35740119
The Fortinet is a Firerwall that is capable of doubling as a LAN Router "in a pinch",..it is not designed to be a fully functional LAN Router. When I see people try to make heavy use of them in that sense it often turns out ugly.  It is not a "retail" device so it is not the kind of thing I was asking about.  My comments about that were more of a question to ask what you had then anything else.

How many device (nodes, Hosts) do you have at each physical facility?  That would be one of the  most important pieces of information that we lack here.

Running each remote location on 10.10.1.x, 10.10.2.x, 10.10.3.x is good and proper but you need a "routed relationship" between the facilities,...not a switched L2 relationship.  But that is not a reason to run a /16bit mask on your facility,...in fact it is a specific reason not to.  Running a /16bit mask actually creates an IP Conflict between the sites at a routing level and makes routing impossible,...which leaves you with a Switched (L2) relationship between the sites would would be really really really horrible from a design point of view.

Anyway there needs to be a lot more of your network design made clear and brought out into the open.  Everything you are asking about effects the design,..in fact it is a "design question" and there is really no way to give a correct solution without understanding what is already there to start with.  Along with being picky about my terminology, I am very picky about giving people the "right" advice according to the best of my understanding of the situation,...but I cannot do that without good information to work from.    People are totally free to ignore what I tell them to do,...but I will only give what I think is the correct solution,...I won't give what I think is a second-rate solution or hack-job advice,....I'll just step out of the conversation and let others do that.


0
 
LVL 29

Expert Comment

by:pwindell
ID: 35740465
As I think about what I think you have there, it can be made more efficient.  There probably wouldn't be any VLANs,...it would be all physical (just LANs without the "V").  Give me something to work with and I'll try to give you something decent to consider.
0
 
LVL 12

Accepted Solution

by:
Fidelius earned 2000 total points
ID: 35741174
OK, let's clear one thing, this forum is not about who's wrong and who's right. It's about helping people in need. Not all users are network gurus and they are trying their best and asking for help about things they are no so good at, so let's cut this pointless conversation and move to the issue asked in users question.

swcrook asked for help, so let's help him.

To limit the broadcast domains, you want to create VLANs. OK.
Requirement for that is to subnet your 10.10.0.0/16 network or else everything will be in one big VLAN, and that is not good.

Is any subnetting  possible at all?
As I said in my first reply, if you can subnet your network then we can go further. You can use your firewall device as routing device between VLAN. It will work just fine. It is not best practice, but it will work.

Can you separate your remote locations each in one subnet? If you can, it will be great.
On central location it would be good to put servers on one subnet, and client PC's on other, to minimize broadcast from clients to server.
0
 
LVL 29

Expert Comment

by:pwindell
ID: 35741316
OK, let's clear one thing, this forum is not about who's wrong and who's right.

I'm not calling anyone wrong or right,...and I don't think the conversation is pointless.

To limit the broadcast domains, you want to create VLANs. OK.

No,..you create IP Segments.  Maybe that ends up being VLANs,...and maybe it doesn't,..it depends on the equipment involved and the infrastructure involved,...neither of which we know the truth of in this case.   I'm confident that you already know that, so let's wait till we have the information we need to be able to know what we are talking about.  I have already asked for such information twice in this so-called pointless conversation and am just waiting for the OP to reply with such information.

I have no intention of arguing about all this,..but it looks like that is exactly what you want to do.
0
 
LVL 12

Assisted Solution

by:Fidelius
Fidelius earned 2000 total points
ID: 35741593
No intention to argue from my side either.

So far we know user has four L2 switches and firewall. IP segments will end up as VLANs, as we all know that multiple subnets in same VLAN is bad design.

As I can see, the only real issue here is: Can user subnet his 10.10.0.0/16 range?

@swcrook
Can you post your network topology including example of remote location with connection to central location.

Thanks!
0
 
LVL 29

Expert Comment

by:pwindell
ID: 35741956
No intention to argue from my side either.

Ok, no problem.

Can user subnet his 10.10.0.0/16 range?

He won't be able to.  As Mr Monk always said,.."Here the thing".  He just can't start changing the mask from /16 to /24. As soon as he does it will take down the whole infrastructure because the Central Site and remote Sites could not longer communicate due to now being different subnets but with over lapping addresses spaces,...remember the remote Sites still would have the /16 mask because he can't be everywhere at once to reconfigure everything at once,.. plus the VPN Tunnels are built around that.  He said earlier "....down the line until we reach the 100+ plus stores...." so even if they only have half of that,...say maybe 50 remote sites,..that would make quite a mess.

Here the approach.  Start at one remote Site, take down the Tunnel and "unconfigure" it.  Re-address the Remote Site using an address Range that is totally and completely outside of the original 10.10.?.? range.  Then recreate/reconfigure the Tunnel and while doing that establish it as a routed relationship instead of the L2 relationship that it appears to previously have been.

Repeat this at every Site, systematically, one at a time.   When finished, the Main Site is still using the 10.10.?.? with a /16bit mask.  So then all that is left is to make sure that all the equipment is set to the same first three octets (I'm assuming there is less than 200 machines at the main Site).  Then change the Mask on all the equipment to a /24,...and it is done. They can retain their existing IP# as long as the first 3 octets are the same

Things to note:

1. The 4 Procurves in the equipment room in the original question were never involved,...at all.

2. No VLANs were created. A VLAN is a specific thing involving a specific technology refereed to in IEEE 802.1Q which often, but not always, includes Frame Tagging.  So just because an IP Segment was created and setup does not make it a VLAN.   Now does that mean that it isn't possible that some product might incorrectly call something a VLAN in the Docs or in the User Interface?  No,...people who write Documentation and design User Interfaces screw up and misuse terminology all that time,..that's why this industry is so screwed up today.  

I am also making the following assumptions about the system since I lack the details I'd like to have (and I hate doing that).

1. I am assuming there are less than 200 machines at each location.

2. I am assuming there is a Fortinet Device at each location and that a Site-2-Site VPN Tunnel is use between the "pair" of devices.

3. I am assuming that there is no dedicated Point-to-point private lease lines (as opposed to VPNs) between the sites using dedicated routing devices with the Fortinets being used as only Local Firewalls.

4. I am assuming that the relationship between the Sites is all Layer2-Switched.  I base this on him saying that he had to keep the /16bit mask in order to communicate with the other sites that are using Address Ranges that fit within the same /16 Network range

0
 
LVL 12

Expert Comment

by:Fidelius
ID: 35742200
I agree with pwindell. That is the right direction to go.
Just one note. Even if you don't create any VLAN, on every managed switch there is at least VLAN 1, by default native or untagged.
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question