Solved

Design of VLANs

Posted on 2012-03-12
5
464 Views
Last Modified: 2012-05-15
I am working with a client who has some Cisco equipment.

network design is very simple now ; all machines in one VLAN and one subnet.

they like to go with a VLAN based solution , they have a Cisco switch 3750 (24 port) and a ASA (5510) . They also have six Dlink (layer3) switches.

The Idea is to use Cisco 3750 as a core switch ; subnet network to 5 different IP ranges ( for 5 departments ) and put each department on a separate VLAN.

They also have another location which will be connected to primary site using a site-to-site VPN (through Cisco ASA) .So ASA provides site-to-site connectivity and Internet access.

machines on that site also need to be in a different VLAN but should be able to talk to servers in primary site.


so .. with this scenario in mind ; here are my thoughts :

we need one dedicated switch on each subnet ( probably those Dlinks)
we need to enable trunking on each Dlink switch.
Each Dlink switch  will be connected to core Cisco switch using its trunk interface.
Core switch performs required routing and send traffic to ASA if required.

Is this right ? I am not quiet sure if ASA should be VLAN aware too ... any thoughts ?
0
Comment
Question by:akhalighi
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 4

Expert Comment

by:schmitty007
ID: 37710618
In this scenario your 3750 L3 switch can do the routing between Vlans and you would need to trunk the ports between switches. So your ASA would only have to know that the other subnets are reachable through the 3750.

 There is no need to dedicate one switch per VLAN unless you just wanted to, it is possible to simply assign different switchports to access the vlan intended. It would help to understand the physical topology to answer this question. Are the devices in these 5 different areas cabled back to the same data closet or different closets?

 You would have all 5 Vlans on all switches and simply assign a range/specific ports to each VLAN. You could also use VTP to manage Vlans across the switches if you had a native cisco switching environment.

Example
Int fa0/1
switchport access vlan 10

int Fa0/2
switchport access vlan 20

I would shutdown Vlan1 and pick one Vlan to be your management Vlan for your switches.
I would also recommend using RPVST - rapid per vlan spanning tree.
0
 
LVL 10

Author Comment

by:akhalighi
ID: 37711807
Thanks for all information , can we enable rapid spanning tree even in a Dlink-Cisco mix ?
0
 
LVL 4

Expert Comment

by:schmitty007
ID: 37711848
Spanning-tree is IEEE and is not proprietary to cisco so as long as the switch itself supports RPVSPT then absolutely. You said they are L3 switches so I would assume yes but, to confirm just look up the model numbers on the manufactures website it should confirm / deny.
0
 
LVL 29

Accepted Solution

by:
pwindell earned 500 total points
ID: 37748808
The Idea is to use Cisco 3750 as a core switch ; subnet network to 5 different IP ranges ( for 5 departments ) and put each department on a separate VLAN.

That is the wrong reason to want to do that in most cases.
The primary reason would be because you have more than 200 machines on a segment and it is starting to suffer degradation from the level of Broadcasts.

If you have less than 200 machines, and have no special case security needs,...then leave everything in a single segment.

VLANs,...I try pretty hard to not even use the term, the trem often just creates confusion, voodoo, and visions in people's minds that go beyond all it really amounts to in the end.    An L3 Segment is an L3 Segment, how you "get there" is not that relevant.   If it is a conventional LAN Router it is based on the physical interfaces of the device,...if it is an L3 Switch then it is based on how you group the Switch Ports into logical Router Interfaces by using the VLAN config,...but in the end,...either way,....L3 Segments and just L3 Segments.
0
 
LVL 29

Expert Comment

by:pwindell
ID: 37748822
Simple principle to follow:

For every 200 machines,...create a new /24 (254 host) Segment.

Whether that is done with physical interfaces on a convention LAN Router or with virtualized Interfaces on a L3 Switch really doesn't matter.
0

Featured Post

MIM Survival Guide for Service Desk Managers

Major incidents can send mastered service desk processes into disorder. Systems and tools produce the data needed to resolve these incidents, but your challenge is getting that information to the right people fast. Check out the Survival Guide and begin bringing order to chaos.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
When speed and performance are vital to revenue, companies must have complete confidence in their cloud environment.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question