1

I've recently become network administrator in a small office. In this office, there are 3 people which are leasing a shared space; each person is an independent entity requiring segregated networking from the other entities. They asked to have a private subnet for each of them.

In total, we have 4 subnets:

  • primary company, so it uses internal email traffic, file sharing along with confidential clients' information
  • independent company 1
  • independent company 2
  • independent company 3

An external company configured a Watchguard Firebox to provide these subnets (it firewalls all of the subnets so that they can't see each other, it only allows WAN access for the Internet), so this problem is solved. My task is to provide the 3 additional subnets to the 2nd floor, one per wall plug.

1st floor rack is composed of: Firebox, 2 fiber-optic-linked Netgear GS748T (managed switches) and some patch panels. 2nd floor rack is composed of: 2 linked hubs and 2 patch panels. In one of the hubs, 2 cables are incoming from the 1st floor (I don't know why they're 2). At the moment, there's only a single VLAN set.

My question is: can I provide access to the other three subnets in the leased room using the current cables? The obvious solution would be putting a cable between a Firebox port and the patch panel, repeated three times, bypassing switches which are for the "real" office subnet.

I omitted first floor patch panels as they're not relevant to my question. Red wire is for primary company's subnet. I don't know if it's all clear. Let me know :)

  • You could improve your question by editing it to add more details. You may find our Question Checklist helpful when editing your question. For example: at least the configuration from the devices and a diagram would help us to be able to provide an answer and not simply provide guesses as to what was done and what can be done. – YLearn Jul 6 '15 at 18:51
  • If I had to guess, and it can only be a guess without knowing configurations, you are running a single VLAN internally. If your unmanaged switches (I sincerely hope they aren't really hubs) were managed switches, you could probably carry multiple VLANs over the connection between the first and second floors. As it stands, you really have no way of delivering additional subnets from the Firebox without additional cables. As for the two links from the first to second floor, I would guess redundancy, although depending on model of switch they could be introducing a L2 loop as diagrammed. – YLearn Jul 7 '15 at 2:20
  • If a patch panel on floor 2 has many lines to floor 1 patch, this is as easy as doing the patch (if the isolated networks are only needed on one jack each on floor 2) - it's still not clear from this diagram (and you may not yet know) what you have in place for floor-to-floor wiring. A patch panel is not a thing that floats in space - it has wires attached and they go somewhere. If you have one panel that goes to offices and one that goes to the floor above/below, then this is an easy matter of patching from Firebox to Patch Up and (on floor 2) from Patch Down to Patch Office A, etc. – Ecnerwal Jul 7 '15 at 4:19
  • @YLearn, yes you're right, there's a single VLAN. And on 2nd floor devices I read "hub", don't know if actually this word is used as synonym of "switch" in that case. Anyway, I'm sure they're not managed. Ecnerwal, I sincerely don't know if the patch panels are linked together. But I don't think so, in the 2nd floor closet I can only see 2 cables coming from the bottom. I could try to contact the guy who placed all the wires. – LivingSilver94 Jul 7 '15 at 8:12
3

Without knowing what, exactly, has been done by "outside vendor" I'm going to guess that each "company" has a separate VLAN (virtual LAN.) That is the most common way to isolate entities that should not have the ability to snoop on each other's network traffic that share infrastructure.

If you have the password to access the switches you should be able to see if that is the case by examining the switch setup and mapping the port destination to any defined VLANs on the switch ports.

If so, you should be able to make access to any VLAN from any port. Keep your most ethical self in control when doing this. Hmm - actually, if you have "dumb hubs" on the second floor, you may need to upgrade those to a "smart switch" for proper VLAN handling. Or, if there is adequate cabling in the patch between first and second, and switch ports on the first, you just patch on the second floor, using switch ports on the first floor. To know what your options are, you really need to know (or describe) what you actually have, cable-wise.

If you have a VLAN-capable switch on the second floor, one wire can carry 4 VLANs between floors and then the switch can deliver them to the proper wall jacks.

OK. If you only have two cables (which for some reason are both connected from down to up on the "main company - building owner" network, and if you get a smart/managed/vlan capable switch for upstairs (probably only need one, really, at least for the scale of the problem so far) then you will need to set up VLANs on a downstairs switch for the building owner and each client. You'd plug each client into an "untagged" port on the downstairs switch assigned to their VLAN; on (at least one of) the lines running between down and up you have a port on a downstairs switch that is assigned to all 4 VLANS, tagged (which is how one wire carries 4 networks) and that connects to a port on the upstairs switch which also has all 4 of those VLANs, tagged. Then on the upstairs switch you break out the 3 "customer" VLANs to untagged ports which you patch to their assigned wall ports, and the company VLAN to the other ports (or to only the actual ports in use, as a better "best practice" which does require remembering that you need to reconfigure the switch when/if you move cables around.)

With smart/managed switches, the two lines from downstairs to upstairs can be configured as a LACP so that data can move twice as fast over the pair of cables.

  • I'll ask if the company will buy managed switches to replace these dumb hubs. I wasn't sure if a single cable could carry multiple VLANs. Thank you :) – LivingSilver94 Jul 7 '15 at 8:20
  • Great! I'll see what of the 2 solutions (new wires, new switches) is less expensive, then. A last question, then I'll mark your answer as definitive: is there a way to detect from what downstairs switch port a wire is running upstairs? Only trial-and-error method? – LivingSilver94 Jul 7 '15 at 14:37
  • @LivingSilver94 Outside of regular office hours (with a helper if at all possible) going through unplugging and seeing what stops being lit up, plugging back in and seeing what lights up, and taking careful notes is unfortunately your best bet in most cases. There are specialized tools where you can map multiple cables (taken out of service) simultaneously, but they don't make much sense for a small office to buy. Do try to make the most of the effort and label everything as you sort it out, since it presumably lacks adequate labels now if you're resorting to this. – Ecnerwal Jul 7 '15 at 15:03
  • Thanks for all the details. Actually there are no labels at all. Best answer chosen ;-) – LivingSilver94 Jul 7 '15 at 16:20
0

A subnet is a logical segregation of traffic.

This isn't something simply achieved by the number of network cables you have. This is something you have to plan and configure.

Based on your description of the problem, there is no reasoning behind segregating the traffic; technically speaking, all computers are on their own subnets (/32). They are also on the same subnet that allows the computers to communicate with each other, the server(s) and the Internet(s).

If you desperately want to give each person their own subnet, you can, but depending on your network switch/router, it could be a lot of work for no reason; and if you don't know what you're doing on the switch/router, you could mute traffic for one or all of your users.

Since it sounds like you don't what a subnet is, I'll put it in terms you might be able to understand, with very basic and very simple examples. If you bring up your network settings, either through the operating system's GUI or command prompt/terminal, you should see something like:

IP Address: 192.168.1.29
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1

This configuration shows that the device is on the subnet 192.168.1.0/24.

If the configuration was:

IP Address: 192.168.2.20
Subnet Mask: 255.255.255.0
Gateway: 192.168.2.1

Then the subnet would be 192.168.2.0/24.

Note: the /24 is a denotation of the subnet size.

If you look at both configurations, you'll notice that each configuration has a different Gateway address. Every subnet needs a gateway, so it knows how to send traffic. If a subnet doesn't have a gateway, it won't be able to route traffic. However, every gateway needs a physical address; this mean it needs to be tied to a NIC/port, unless your switch/router can generate virtual NIC/ports. If I've lost you here, it means you need to read several books on networking or get Network+ certified before you go any further.

Alternatively, you could go the easy way, and get every person one of those home routers, then plug those home routers to your main switch. This would effectively give everyone their own subnet (both physically and logically), like they asked, but they wouldn't be able to work together or share local resources.

TL;DR: Your users don't know what they're talking about, asking for different subnets. I think everyone involved has watched a little too much TV.

  • lmao, do I appear that noob? I'm thinking I'm not able to write a question in the right way. OK I'm a University student, but I studied IT in high school. The three user don't want to share anything, but they want internet access from the pre-existent infrastructure. Is using subnets that bad? – LivingSilver94 Jul 6 '15 at 13:25
  • No, it's not bad. It's just a lot of work if it's a 'preference' rather than a 'need'. Keeping your network simple makes it easier to resolve problems in the future. If you're a University student, you should have learned KISS by now. Also, putting people on different subnets doesn't guarantee segregation of traffic. You're better off putting a firewall on each computer and disabling file sharing if they're looking for security. – CIA Jul 6 '15 at 13:28
  • I see. How would you solve the problem without subnets? You mean KISS philosophy? In USA, maybe. Here in Italy, first year of Information Engineering is (basically) about math only. – LivingSilver94 Jul 6 '15 at 13:33
  • Watchguard Firebox already firewalls the subnets. Also, the "real" subnet hosts a server with many folders shared. If the 3 users didn't share anything, they would still be able to watch into company's files. – LivingSilver94 Jul 6 '15 at 13:40
  • It depends on why the users want to keep their data/traffic segregated. If all the people are in the same room and they work for the same company, doing the same job, there is no reason for separate subnets. If you have lots of computers that do lots of traffic (like file servers, VOIP servers, web servers and email servers) and different security requirements, then adding subnets makes sense. KISS means: Keep It Simple Stupid. If you add complexity for no reason, then you make your job harder for everyone else. – CIA Jul 6 '15 at 13:40
0

You want to create a VLAN per subnet. These additional VLANs should be configured on all switches that have ports connecting devices for respective VLAN. This VLAN configuration can be done manually per switch or dynamically/automatically via a trunking protocol like VTP.

In any case, the link between switches will need to be a trunk link - meaning it carries frames for all VLANs. Finally, you will need a layer 3 device (perhaps your switches are layer 3) to act as default gateway for each VLAN and provide routing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.