I have an upcoming project in which I need to create and divide our company production , database, web, etc. servers into different vlan and how certain users (regular user, admins) with rights is able to have access to certain servers. Currently all the servers are on the same subnet /20 and users are on a different subnet /24. What would be the best way to approach this considering we have 100 servers and 200 users? Please state the pros and cons of each approach. Any suggestion is appreciated. Thanks in advance!
100 servers and 200 users - there are a lot of ways to segregate that. But since you have clearly said that you want to divide by function (prod, db, web, etc) I'd suggest the following:
SERVERS: Take the 100 servers that are currently on the /20. Divide them up by function. For each function, add in 'room-for-growth'. This is probably the hard part. But better to plan at this stage. Then start subnetting.
Depending on your requirement, it may or may not make sense to have a consistent mask throughout. Say one subnet needs only 4 ips, and another needs 200, it doesnt make sense to keep a /24 throughout. But if the numbers are more or less the same, then use the same mask. Consistency will pay off when you are trying to automate things later.
USERS: Then take the user network, and segment it similar to what you did for the servers. These are both independent of each other, I assume. You will have IP ACLs on a higher protocol layer , to control access.
You can create access-list, that can be applied on the interfaces in outgoing direction, matching some traffic with the IP that you need.
Also you can work with iptables on your server,. but, on the other hand, why you want to use vlans??
I would create VLANs (w/ SVIs) for each group that needs to be separated. That is the easy part. As far as permissions, you can do it the easy way via AD or the hard way would be access lists based on users IP addresses that are assigned to them. You can use reservations in DHCP, but at the scale you are talking this would never work efficiently. There are some good security tools (Cisco ISE) that can look into the type of traffic and allow or block based on users/systems, etc.