• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 378
  • Last Modified:

Network design

Hi Experts

have a brand new firewall and six 24 ports L3 capable HP switches ; existing network is small (<150 wks) ; currently running over L2 switches and little hubs !

Trying to get some good benefits from all these new equipments . so , my thought is like this :

Let's say we will have 2 VLANs : VLAN 1 and VLAN2
VLAN 1 :
Intra-VLAN routing should be enabled so that devices can talk to each other.

so , as far as I know , I have to create VLANs on the core switch ; dedicate interfaces to them and assign IP addresses on respective VLAN :
e.g :

 Interface GigaEthernet 0/1 / IP address :

VLAN 2  
Interface GigaEthernet 0/2 / IP address :

let's imagine IP routing is enabled on this switch . so these 2 VLANs can talk to each other . also ; probably I can define another interface and  set static routs to send Internet traffic toward edge firewall.

Let's also imagine 5 other switches are connected (using 1 GB connections) and ports are
assigned to different VLANs, I think one GB trunking port should be considered on each of these five switches.

My dummy questions for now :

How physically I connect remaining 5 switches to core switch ? should I expect 5 trunk connections to core switch ? how interfaces on core switch will talk to trunk links ?
  • 4
  • 3
1 Solution
James HIT DirectorCommented:
Simple answer, Yes you will want 5 trunk connections (one for each switch) if you want to pass through the multiple VLAN's.
Dot1q Trunk will negotiate connection between switches.
JAN PAKULACommented:
best way would be to connect 5 switches with trunks but also us lacp to aggregate (group) ports - use 2 for each switch - you will have to use 10 ports on main switch but it is well worth it.

1 if one link fails you always have second one to given port
2 you gaining internal bandwidth - 2Gbps from each switch to core switch - server wise it does speed up everything. - end devices can pull much more data on shorter periods of time (shared folders or networked drives)

akhalighiAuthor Commented:
yeah , but how we physically connect them to core ?
Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

JAN PAKULACommented:
star connection -  2 cables from each switch to core
akhalighiAuthor Commented:
1- okay so .. let say we connect two ports from a given switch to core ; what specific configuration on the core switch is needed ? where I set the IPs ? and on what interface ?

2- what happens to rest of unused ports on core switch ? are they wasted ?
JAN PAKULACommented:
what type of hp switches do you have?

@1 you set up ips and subnetmasks on ethercahnnels groups of ports (lacp agregation) - not on physical interface ports
you also enable trunking on etherchannels groups.

@2 core server connects to your firewall and if possible put all your servers on it (if cpu of switch is powerful enough - you should be able to monitor it)
akhalighiAuthor Commented:
HP 3800 switches .

1-I still don't get it . lets say we have two VLANs ; and ;
we also have two cables (in a group coming from each access switch to core)

So I have 5 pairs coming to core switch with trunk enabled , getting 10 ports in total .

so that I will have 5 grouped interfaces on my switch . Where do I set up IP addresses of two VLANs to become the default gateway ?

2- so can I have my serevrs connected to let's say VLAN 3 on core switch talking to rest of VLANs ?
JAN PAKULACommented:
@1 As long as the two building "NEVER" share layer 2, you can use the same VLAN ids.  

However, you can not share IP subnets.  VLAN20 in building #1 should be a different subnet than from building #2.

Users should not care what VLAN they are on.  Users should not even know what VLAN they are on.  All they should know is they can get to the resources they need.  

Now what why/how are you grouping people.  By floor, by department, or something else?

If by floor, then you could something like:

VLAN10y = 10.x.y.0/24

Where X = 1 or 2 for building 1 or building 2 and Y = the floor they are on.

Now if you are doing it by department and you have departments split across buildings, you need to decide do you want the departments to be in separate IP subnets based on whcih building they are in or bit the bullet and bridge L2 between the building so that everybody in department X is in the same IP subnet no matter which building they are in.

also check that

and that


@2 yes if you have intervlan routing enabled (vlan 3 is allowed to pass ports in both vlan 1 and 2)

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now