Solved

VLAN assigments

Posted on 2012-03-10
12
233 Views
Last Modified: 2014-08-01
Hello,

I am new to vlan and I just have a few questions. I have two buildings, each with its own core, distribution, and access. But everything is in vlan1. I am in the process of redesigning the vlan infrastructure. All of layer 2 stop at the distribution layer. From the distribution to the core, it is all layer 3. So I keep the vlan within the building. The two building communicates via MPLS. My questions are:
- For the management vlan, let say vlan 300. Can I use the same management vlan for both building? Or they have to be different?
- Do the vlans have to be unique throughout my two building network? Let say I  have a user in building 1 with vlan 20 and and he moves to building 2 but still want to be in vlan 20. How will this work as there is a 1-to-1 mapping with vlan and subnet. In other words, I assign a subnet (vlan 20 = 10.10.10.10/24) in my distribution switch. Now if he moves to building 2, how will I configure the distribution switch in building 2?

Thanks
0
Comment
Question by:mynet
  • 4
  • 3
  • 2
  • +1
12 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 37705770
As long as the two building "NEVER" share layer 2, you can use the same VLAN ids.  

However, you can not share IP subnets.  VLAN20 in building #1 should be a different subnet than from building #2.

Users should not care what VLAN they are on.  Users should not even know what VLAN they are on.  All they should know is they can get to the resources they need.  

Now what why/how are you grouping people.  By floor, by department, or something else?

If by floor, then you could something like:

VLAN10y = 10.x.y.0/24

Where X = 1 or 2 for building 1 or building 2 and Y = the floor they are on.

Now if you are doing it by department and you have departments split across buildings, you need to decide do you want the departments to be in separate IP subnets based on whcih building they are in or bit the bullet and bridge L2 between the building so that everybody in department X is in the same IP subnet no matter which building they are in.
0
 

Author Comment

by:mynet
ID: 37705964
"Now if you are doing it by department and you have departments split across buildings, you need to decide do you want the departments to be in separate IP subnets based on whcih building they are in or bit the bullet and bridge L2 between the building so that everybody in department X is in the same IP subnet no matter which building they are in"

This is what I am trying to understand. Cisco recommends to keep the vlan local. So if the department A in building 1 has vlan20 (10.20.20.20/24) and some of the users of department A is in building 2. I can then assign vlan20 in building 2 with different subnet, say 10.20.21.20/24. Then I can say that vlan20 is for department A. The users for department A can communicate with each other via layer 3. Does it sound right? Thx
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37705973
How far apart are the buildings?  What is the speed of the MPLS network?
0
 

Expert Comment

by:abhinavgupta72
ID: 37721628
this can only be possible if your core layer consist of layer 3 switches.
VLAN sharing is possible with switches(L2or3), they can share VLANs.
routers do not understand VLAN. they can only do routing between VLANs with the help of subinterfaces.
if you are using routers at core layer, this can't be possible.

But if you have router at core layer, then you can use VLAN separately.
0
 

Author Comment

by:mynet
ID: 37722483
The core is doing routing. All L2 is from access layer to the distribution layer. Not sure why you need to know the distance of the building and the speed of the MPLS network. We switch from access to distribution and we route from distribution to core. We also route between building. We can use any connectivity between buildings (fiber, MPLS, frame relay, T1, etc...). My question is if I assign vlan 20 to an access switch port in building 1, can I assign the same vlan 20 to an access port in building 2? If I want to keep my vlan local, I will assign a subnet to vlan20 in building 1 and another subnet to vlan20 in building 2. Is that the best practice?
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 57

Accepted Solution

by:
giltjr earned 500 total points
ID: 37724471
The reason for knowing the distance and speed, is that if they are close enough and there is enough bandwidth you could consider trying to bridge the two site so that they are on the same L2 network.  That way you could have vlan's span the two buildings.

However, if the buildings were, say 3,000 miles apart and you had 1.5 mbps of allowed bandwidth, then you would NOT want to do this.

Now, if you do not want to consider bridging the two site, which is a fine decision, then:

1) You can have the same VLAN id's at both sites, that is VLAN20 can exist in building 1 and building 2.

2) You can NOT have the same IP subnet in both buildings.  Well technically you could, but it would cause some problems.

Now, you asked

--> Do the vlans have to be unique throughout my two building network? Let say I  have a user in building 1 with vlan 20 and and he moves to building 2 but still want to be in vlan 20"

No they do not have to be unique.  The user can choose to be in VLAN 20, but YOU need to decide that.  VLAN 20 in one building will have nothing to do with VLAN20 in the other building.  You may use VLAN20 for accounting in building1 and VLAN20 for

However, unless I was going to have hundreds of VLAN's I would make the VLAN's between building unique and use on of the positions to identify which building the VLAN is in.  Like VLAN1xx is building #1 and VLAN2xx is building #2.  That makes documenting things MUCH easier.

Think of it this way.  There is NO difference from building1 being routed to building2 and building1 being routed to my office.  They are two different networks that when they need to talk to each other need to be routed.  Your network knows nothing about my vlan's and I know nothing about your vlans.

Remember a vlan is nothing more than a way to break up a layer 2 network and layer 2 networks never cross the boundary of a router.
0
 

Author Comment

by:mynet
ID: 37725909
giltjr,

Thanks for the explanation. That is exactly what I wanted to find out.
Now by bridging 2 buildings, you meant build the trunk between the 2 building. Correct? If yes then I may as well use a provider that provides ethernet switch technology and build the trunk that way. Correct?
0
 
LVL 29

Expert Comment

by:pwindell
ID: 37748892
Now by bridging 2 buildings, you meant build the trunk between the 2 building. Correct?

Bridging is just bridging.  It doesn't have anything to do with Trunks,...Trunks are for running more than one L3 Segment over the same cable,...which generally speaking,...is "bad" and a poor way to maximize the bandwidth capacity of the cabling.

If the links between the building is very fast,...and you don't end up with more than 200 machine per L3 Segment combining the building together,.... Bridging is fine,....

If you use WAN Links between the buildings,...or if you end up with more than 200 machines when combining the buildings together,... then you want each building to be a different subnet and use a L3 routed connection between the buildings.    Although a hybrid option is to bridge across the buildings but then route into a new L3 Segment as soon as you jump the gap between the buildings.   The hybrid is common when you  jump the gap between the buildings using a Wireless Bridging technology such as Microwave,...so you jump the gap at L2 and dive right into L3 as soon as you get there.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37749308
Yes, setting up a L2 trunk that allows multiple tag'ed VLAN's to extend between the buildings.

It was not meant as a way to maximize bandwidth, as it will NOT do that.  If anything it will waste bandwidth because of the extra traffic dealing with broadcasts.

However, if a user needed to be on a specific VLAN/IP subnet and moved from building#1 to building#2 and for some reason had to be on the same VLAN/IP subnet, then the only way to accomplish that is to create a L2 bridge between the two building allow at least that VLAN to extend between the buildings.

In the original question he asked what would happen of a user moved from building#1 to building#2 and wanted to be on the same VLAN.  So I provided an option that would allow that, assuming it was really meant to ask if he wanted/needed to be on the same IP subnet.
0
 
LVL 29

Expert Comment

by:pwindell
ID: 37749411
Sounds like we are in complete agreement.

I prefer to talk him out of even allowing a situation of "..if a user wants to move to another building and stay in same subnet....".

It is a domino effect thing,...if you don't create a situation where it matters what subnet the use is in,...then it won't matter if the user is going to end up in a different subnet when they move to another building.  Except for Server, printers, and networking hardware,...it should never matter what IP a machine has to start with, therefore it doesn't matter what subnet it is in.

If a person can roll the string of choices back to the beginning and stop the first bad decision from being made then the 2nd, 3rd, 4th, and 5th bad decisions (dominos) will never happen.   It is sometimes a fight getting people to change their thinking, but a fight worth fighting,...in all the years I been doing this,...I usually win when it is an "in person" situation,...internet forums not so much.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now