1

So I'm working on setting up a new ip addressing schema for a network. Here is the current plan:

10.1.0.0  -> VLAN 100 -> Server Farm
10.1.4.0  -> VLAN 104 -> Admin Wired Data
10.1.8.0  -> VLAN 108 -> Admin Wireless Data
10.1.12.0 -> VLAN 112 -> Guest Wireless

Routers  -> .1 - .3
Switches -> .5 - .9
Printers -> .10 - .14
Reserved -> .15 - .19
DHCP     -> .20 - x.255

So my question is do the switches get the same ip address in each of the subnets to be able to be managed? Or do I just give it an ip address in say the server farm subnet for management abilities?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14 '17 at 23:11
1

If the switch is a layer-2 switch, you only need to give it an address in one of the VLANs. You could give it an address in each of the VLANs, but that has its flaws. You may want a Management VLAN for the switches, WAPs, etc, and restrict access to that VLAN with ACLs.

Improve this answer
4
  • Thank you! So I should say make another vlan that is solely for the management of the network equipment ? 10.0.0.0 -> VLAN 1 -> Network Management ?
    – William
    Aug 9 '16 at 18:06
  • That would be a more secure way to do it. You could not only have authentication on the network devices, but you could use ACLs to limit access from certain VLANs or IP addresses. Security should be layered.
    – Ron Maupin ♦
    Aug 9 '16 at 18:08
  • If you are going to create ACLs on your router to restrict access to the switch, then create a separate VLAN. If you aren't, then don't bother with a separate VLAN.
    – Ron Trunk
    Aug 9 '16 at 18:47
  • Right, but don't address one switch in VLAN 10, another in VLAN 20, etc. It should be consistently a single VLAN.
    – Ron Maupin ♦
    Aug 9 '16 at 18:51
1

A good security practice is to separate management and user data traffic. The management VLAN, which is VLAN 1 by default, should be changed to a separate, distinct VLAN. To communicate remotely with a Cisco switch for management purposes, the switch must have an IP address configured on the management VLAN.

http://www.ciscopress.com/articles/article.asp?p=2181837&seqNum=11

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.