VLan questions

I am looking to implement vlans on our network soon.  I thought of starting by segmenting:

management
servers
dhcp
printing
wireless

Anything else I should separate?  

If i'm not worried much about security, can I just allow the switches to be managed on any of the Vlans?

Do I need the dhcp server to be on the dhcp vlan?  I'm guessing so.  

Do I need the print server to be in the same vlan as the printers?  I 'm guessing not.  Is there any advantage one way or the other?

Any other useful tidbits on vlans that might be helpful to somebody just starting out?

Thanks!
readymadeAsked:
Who is Participating?
 
kevinhiggCommented:
Good evening!  If you're preparing to segment your network, you likely already know some of this, but here are a few additional thoughts.  Make your design no more complex than you have to :)  VLAN's are an awesome tool, but carry some additional overhead.  The usual reasons to implement multiple VLAN's would be security or access control, defining and controlling a broadcast domain and / or possibly organization.

I suppose that you could have the switches manageable from multiple VLAN's, but what do you intend to have resident on the management network?  And what will be managing the routing for these new networks (are these layer 3 switches)?  Is your existing network largely flat?  What do you expect to have on the DHCP VLAN?  This service will likely live on one of your servers or pieces of network kit, right?  And you will obviously need a way for your clients on the other networks to gain access to a DHCP lease, right?  I guess that I don't quite follow the intent for this VLAN, but you will need to permit the clients to gain an address lease in your new design.  You will need a DHCP relay agent of some sort on each of the other networks.  This is often implemented with the "ip helper-address" command.

What are your plans for the printer VLAN?  Moving all of your physical print devices to this network?  The print server wouldn't have to be local, but you'll be sending print data across a layer 3 device (your router) where you likely wouldn't today.  Unless you're a huge print shop, this additional overhead isn't likely to cause you any specific problems, but make sure that it offers a worthwhile benefit.  ;)  Best of luck!
0
 
readymadeAuthor Commented:
Yes the network is flat, and too large.  Too many devices.  

We have layer 3 switches.  I can do the routing.  

DHCP Vlan would be clients.  Desktops, laptops.  If putting the dhcp server on the dhcp vlan is easier, that is fine I think.  I assume I wouldn't need a relay then.  

Yes moving all printers to one vlan.  

Mostly the reason is to segment broadcast traffic.  We are growing rapidly, so that is important, and security will become more important.
0
 
kevinhiggCommented:
Got it; DHCP will be used for the client data VLAN.  Adding the helper addresses shouldn't be too difficult, and would likely be preferred for a few reasons (security being paramount) over having it on the client access VLAN.  If you eventually have multiple client data (access) VLAN's, you wouldn't necessarily want to multi-home your server on each.  But adding a new helper address shouldn't be a big deal, and will let your single DHCP daemon live somewhere safer, but continue to grow to meet your needs.  Out of curiosity, what's the mask on your existing network?  Kind regards.
0
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

 
SebastianAbbinantiCommented:
It typically makes sense to logically divide networks into VLANs based on functional groups. For example, you may find that some departments should be logically separated from others. For example, the Accounting department may have its only VLAN or the Sales department may have its own VLAN.

Certainly a guest wireless network would get its own VLAN, and its logical that all the organization's servers be in one VLAN. Printers, however, tend to make more sense in the same VLAN as the workstations that would be printing to them.

Readymade's point above is a good one. Don't make it more complex than it has to be.

Remember the primary reason for VLAN's is security. The second reason is for QoS.

Thanks,
S.
0
 
gsmartinManager of ITCommented:
I wouldn't label DHCP VLAN as such because you may have multiple VLANs that require DHCP.  In my environment I use multiple DHCP VLANs with the following VLAN name types General Users, Guest WiFi, BYOD (for our Account Executives/Sales), Executives, Finance, IT, etc... that are all DHCP VLANs.  DHCP server resides on the corporate server VLAN.  I use IP helper-address to DHCP relay traffic back to the corporate server VLAN.

For my IP addressing scheme I use a 10.SITE.VLAN.HOST/24 structure, which I then logically group up based on VLAN categories as well as segment the groups based on wildcard masks.  Ultimately, grouping the categories in (2, 4, 8, 16, 32, etc..) bit segments.  This grouping enables you to streamline your ACLs into single line ACL commands.   Also, this architecture allows you to scale your environment from a small group of VLANs to as many as 256 VLANs.  FYI...  For my architecture I don't use 0 or 255 in the third octet (personal preference).  For my WAN connections I use a 10.0.SITE.HOST/30 structure to blend logically with the 10.SITE.VLAN.HOST structure.

FYI... My printer are grouped up on multiple VLANs based on floors and Print Server is located on the corporate VLAN along with other servers (AD (DHCP/DNS), File (DFSR),
Exchange, Print, etc...).   In addition, my business specific Production servers reside in their respective VLAN(s).  Our purpose for using type of VLAN design is to logically segment traffic based on typical Broadcast Storms and Security scenarios.
0
 
readymadeAuthor Commented:
Good info.  What about a management vlan?  For management of the switches.  

Remember, i'm just starting out with the VLans, so I don't want to get too complicated in the beginning.  Can I just make management of the switches possible on any of the VLans at first?
0
 
SebastianAbbinantiCommented:
A Management VLAN is always a good idea. You can create a separate VLAN for management, and provide and IP address for each device you want to manage on this VLAN. If you choose to allow routing to the management via a router (routers can also be managed on this VLAN using dot1Q encapsulation), you can setup an ACL to protect access to the VLAN.

Thanks,
S
0
 
readymadeAuthor Commented:
You're getting a little above my head.  These are layer 3 switches.  So if I, say, wanted to manage the switch on the management vlan while i'm on my laptop on another vlan.....I would just need routing between the dhcp and management vlans, right?
0
 
SebastianAbbinantiCommented:
A layer three switch would need an IP address on each of the networks (VLANS) it will route too. The devices on each VLAN will then have to have the switches IP address (for each individual vlan) as its default gateway.

Thanks,
S.
0
 
readymadeAuthor Commented:
Or I can have static routes, right?
0
 
SebastianAbbinantiCommented:
You can have static routes, but the next hop must always be a connected route.

Thanks,
S.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.