Moving to VLANs from 2 LANS

Question

I asked this question a few weeks ago: Moving to vlans from a basic network

I think the advice the answerer gave was right but I think I want to move forward with segregating my network and trying to make it more efficent.

I basically have 2 routers. One on the outer network is a "Public Lan" that we allow wifi connections to. I also have an internal "Private Lan".

We have 2 internet connections and 2 seperate routers that load balance.

I want to move to a vlan to simplify my network and hopefully speed it up.

The outer Peplink router is gigabit and handles my 150mb connection without an issue and the inner router is also a peplink but only does 100mb and a fiber connection we use for voip.

Am I correct in thinking that I can use one vlan aware switch out of my router and use that to send my vlans to the dumb switches in each area?

What about this diagram? Is it representative of a setup like this?

I want engineering stuff to be seperate from the office staff stuff but I want the phones for each to reach the voip server as do I want the printer available to everyone. Except some ap users.

Or am I over thinking this? I really think I want to go to one router and just make sure AP users can not reach the private network. That way I can take full advantage of my 150MB connection while still keeping everything simple. I would like to have my phones, my office computers, my engineering gear and my ap users all on seperate subnets just for organization sake.

Answer 1

First all first you should define the policy of your segmentation, starting by defining broadcast domains (ie. VLANs and related subnets) you want to have. In corporate networks, the most diffused reference is the PCI DSS: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf#page11

Anyway, you probably don't need a such formal and strict approach, but still need to define what networks you want to have and how they can communicate between each others.

If I'm reading your question correctly, you want:

• public
• engineering
• office
• voip
• server (only for the printer actually)

I can't say if you're over engineering or not without knowledge of your environment, anyway I think it can be pretty complex for most small networks. For instance, a specific network used for printers only, might be an over engineering, but let's say it will scale easily in case of a new DB/file/web/whatever server. On a side note, restricting specific users to access the printer is something I'd manage through authentication rather than with network security.

Also, by looking at your schema, the 802.1Q switch connected to your Peplink seems the only point where these networks meet, with the only exclusion of the phone (voip). If so, (excluding phones) you don't need VLANs that spread into multiple switches making stuff like STP less efficient, you just need a router/firewall.

VLANs are useful when you want an engineer connected to one of the ports of the switch on the left (public), and someone from the office in one of the 2 switches at the bottom (that seems assigned to engineering in the schema), for instance.

In other words, if I'm understanding your requirements properly, why don't you put a firewall with 5 interfaces where you drew the 802.1q switch , putting the VoIP server and the printers in the server LAN? On the firewall you can define the communication policies between these networks than.

Worth to note that VoIP traffic is usually NOT encrypted, if you're concerned about sniffing of calls from office and engineering this solution might not be the best choice.

Finally, in order to balance the WAN traffic many technologies exists to drive Public network out of a specific link; I don't know Peplink honestly, but with Cisco you can use source/policy routing for instance.

Answer 2

When approaching design issues, I always follow the KISS principle - keep it simple. I dumb switches are, I assume, layer 2 switches - so call them layer 2 switches. They get offended when you call them dumb.

That diagram shows 2 remote sites, which adds complexity not worded in your post. It is common for ip telephony devices to be on a unique VLAN, so this is inline with your want for all phones to reach their server.

In terms of segregating out the engineering computers, you can certainly do that and you would then have a layer 3 boundary between them and the other computers, ...but why? Security? Are you going to enable some network/router based security? If so, what? I am hinting at the KISS principle here. Do you really need to do all that? A remarkable basic reason to segment a LAN is addressing/DHCP server limitations. So, how many computers on the LAN? If not more than 250 or so, you might rethink adding the complexity. A simple layer 3 boundary is not a significant security measure.

Hope that helps.