How would I configure a switch to support 3 networks?

Question

I have a single Juniper switch and a handful of servers. Each server has two NICs plus another NIC for IPMI (management). I would like 1 NIC to be used for public traffic, 1 NIC for private traffic, then IPMI.

For example, each server would be configured as the following:

Server 1:
NIC1: XXX.XXX.XXX.2/24 (public)
NIC2: 10.0.0.2/24 (private)
IPMI: 192.168.0.2/24 (management)
Server 2:
NIC1: XXX.XXX.XXX.3/24 (public)
NIC2: 10.0.0.3/24 (private)
IPMI: 192.168.0.3/24 (management)
etc.

Every NIC on every server would be plugged into the same Juniper switch. Would I need to create 3 VLANs to achieve this? Can a single switch handle all 3 of these without issue?

I would also need to setup a VPN (openvpn) on one of the servers so I can access 192.168.0.0/24 for IPMI from anywhere. Can VLANs talk to each other like that (i.e. the VPN is accessible from a public network (VLAN 10) but needs to access RFC1918 subnet in a different VLAN 192.168.0.0/24 (VLAN 12))?

The datacenter is providing me with a single uplink to the switch for public traffic from their core routing devices.

I hope this make sense. Please point me in the right direction. Assistance is greatly appreciated.

P.S. Purchasing additional hardware is not possible.

Answer 1

Generally speaking about switch configuration.

With VLANs

You can configure VLANs as you mentioned, but you will need router to configure routes and firewall between VLANs so that two devices from different VLANs can/cannot communicate. Each VLAN must have DHCP server or you can assign static IP address to each NIC. You did not mentioned if you have rights to configure the router. You could setup a router on one of your servers. This is the way if you want to set rights which two devices can communicate.

Also, you will need to configure the switch so that each port is assign to only one VLAN (access ports) and trunk port to the router.

Without VLANs

You can do it without VLANs also, but I do not advise it. Switch is Layer2 devices so it does not care about IP addresses. You can assign a IP address as you wish and devices/interfaces that exist on same subnet can communicate. Only devices with public IP could communicate to the Internet, others can communicate only in same subnet.

If you setup a VPN on one server that have a public IP address and IP address for each subnet, then it can communicate with every other devices.

Problem with this solution is broadcast domain. If one device send broadcast request, every other other device will get that broadcast request no matter on which subnet it is. VLANs (and bridges) prevent these things. If a broadcast request is sent on a switch that have VLANs, that request will only be received by interfaces that are member of same VLAN from which broadcast request is sent. Read more about it at https://serverfault.com/questions/25907/what-are-the-implications-of-having-two-subnets-on-the-same-switch

Answer 2

Please forgive me with the short answer. You need a router for your best solution. If you are an open source person, put a 1RU server with 2+ NICs install VyOS. Sorry for the short answer but you need additional device for your best to protect yourself from all the blaming from your boss later as they will do. ;)

Answer 3

The issue with your current set up is that I don't see how you're going to get at the management or private networks. If the private network is simply a subnet to allow the servers to communicate directly (like a webserver running php querying a database server) then you don't need to route to it, but I imagine that isn't true for your management network.

If you cannot change your set up you will need to use the public IP range/gateway that is being provided and use it on both your public and IPMI NICs. You could then ask if the provider would only allow access to IPMI from your offices IPs.

If you use the OpenVPN method then you'll need to have NIC on the openVPN IP range to communicate to the other servers IPMI NICs.

A switch can handle 3 vlans. Just create the vlans on the switch and assign access ports on your switch to the vlan that corresponds to the NIC you're plugged in to. For example, if vlan 2 is for management then set one of the ports on the switch to access vlan 2 and plug your servers IPMI port into it.

Something that has worked for us is connecting a firewall to the provider and then using that to run a site to site tunnel back to us. We can route to over the tunnel to the management ports on the server and can NAT or subnet your public range and assign them to the public NICs on your servers.