2

I have been handed a fun job at work of breaking up a flat network into 4 vlans. This is my first "beginning to end" network project and I have a pretty good idea of what needs to happen, but its been my experience that what I have learned from books and what actually needs to happen can be different. My rough plan is below, details left out for brevity.

Hardware involved: SG200 switches x 3 (one of these SG200s is acting as an access switch, the other two are "core" switches in the server room). The "access" switch will have all of its ports in one VLAN.

Sophos firewall (for routing)

  • ID nodes via mac address; find this mac address in the switch(s) and document which port that mac is associated with, then assign it to a VLAN.
  • Setup Router on a stick using a sophos firewall that is in place. ROAS is due to budget constraints, they turned down the L3 switch proposal. I have setup this config before and don't have any
    questions about this part.

  • The Microsoft server (2008R2) will handle DHCP for each vlan. I have a working multi-vlan DHCP server setup I can clone from another client to make this work and it seems pretty straight forward (but again, assumptions like this can be what slows me down).

    Any advice on setting this up? Some of my questions and self doubt are below:

  • I have this feeling I need to put a "gateway of last resort" into the switches in order to make this work, but I am uncertain.

  • I am a little in the dark on what will happen with the access switch. I know it will need to trunk to the core and the trunk will need to pass the single VLAN needed (which I can configure), can I just leave this as an "open" trunk?

Thats the big pieces that I can think of at this time, I need to put it on paper and pick it apart. I would like to see some feedback from anyone else though, its very helpful when you are starting from nothing. Any considerations before I go to far down this road...?

A great overview of the process is found here (Evan Anderson's post): https://serverfault.com/questions/54417/best-way-to-segment-traffic-vlan-or-subnet

But it lacks a few of the details that have me worried (gateway of last resort for instance).

Improve this question
5
  • If you have to resort to a router on a stick, maybe you don't need VLANs after all. Is there a specific reason to break up your network into VLANs? How many devices are on the network?
    – Ron Trunk
    Commented May 8, 2015 at 23:43
  • They are running out of addresses (have been for a few months). Its a /24 network with 90 employees. Each employee has a workstation. In addition to this they let their employees get on the wifi (the same /24) with their phones/tablets/laptops. They plan on hiring another 25-30 people by July, which will only make the address issue worse. We figured if we had to segment it we might as well move all BYOD devices to their own /24 and then split up the two biggest departments into their own vlan and add a "private" wifi (4 vlans total).
    – Chris Ray
    Commented May 10, 2015 at 23:13
  • Is the Sophos Firewall acting as ROAS also your Internet gateway?
    – Ron Trunk
    Commented May 11, 2015 at 10:59
  • Yes it is. Why do you ask?
    – Chris Ray
    Commented May 11, 2015 at 16:36
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 16:44

1 Answer 1

Reset to default
2

Do you want to multi-home the access switch? You should, however this complicates the configuration. Since you did not specify this, I will assume you do not want to multi-home (a link to each core switch from the access switch).

So, the access switch is flat (single VLAN) therefore no trunking required between it and one of the 2 core switches. Simply be sure the default VLAN is enabled on the uplink port of each switch.

The core switches need to be trunking between them to carry frames from each VLAN.

The gateway (router +security appliance) needs to be trunking to whichever core switch it plugs into (assuming no dual homing). The default VLAN should be present on each interface of this uplink, along with all 3 other VLANs. The gateway needs to be configured with an IP address for each VLAN/subnet so that it can route between them. Each VLAN/subnet's default gateway address is the address of the gateway.

Hope that helps.

Improve this answer
2
  • When you say multihomed, do you mean (for example): Access switch - port 1 ---->core#1 port 1 Access switch - port 2 ----> core#2 port 1 ? If that is the case, I agree but running the new cabling for that is not in the scope of this project (ie budget). When you say the "Default VLAN should be present on each interface..." is this in reference to the sub-interfaces I will create on the firewall? And thanks!
    – Chris Ray
    Commented May 7, 2015 at 15:45
  • In terms of multihomed I mean having the access switch plugged into both core switches (for redundancy). In terms of default VLAN, I mean 802.1q trunking (logical sub-interfaces). 802.1q has a concept of a default or native VLAN. For sanity purposes, have them be the same on both ends.
    – Ronnie Smith
    Commented May 7, 2015 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.