37 computers + 25 mobile phones - Is VLAN implementation recommended?

Question

A small school has 37 pcs and each staff member has a mobile phone (wifi). This calls for roughly 60 devices, connected over wifi. Only the server (planned for file sharing and backups only) will be connected by cable.

Considering "logical units", 15pcs are used in the lab (these Win7 laptops may travel over the school, so in this case VLANs can be a restricting factor), 7 in the office, 15 in classrooms. All APs will be connected to a L2 switch and the switch will be connected to a failover/balancing device, in turn connected to 3 internet lines.

The server (Windows Server 2012) will be managing routing, if necessary (one NIC)

Logical units/devices priority

1. Office
2. Classrooms and lab
3. Mobile phones

Content priority

1. email
2. browsing
3. video playback
4. downloading - cloud sync

Security

Only 3 computers in the office hold sensitive data and may require additional "protection". (this is the only point I would see using VLANs as a stronger solution)

In this scenario, would you recommend using VLANs or it may be overkill?

Maybe it would be easier to setup one unique pool of IP 192.168.1.x (fixed for computers, dynamic for mobile devices and apply QoS and filtering on IP groups); this would make things easier when laptops travel in the school

What do you think?

Answer 1

Segmenting your network into VLANs serves two main purposes.

Creating VLANs reduces the size of your layer 2 failure domains. If your network covers several buildings/ classrooms, etc, you can reduce the effects of failures by segmenting your network according to location (e.g., one vlan per access switch). If you have spanning tree or similar problems, separate VLANs will restrict the problem to only part of your network, instead of taking down the entire thing.

Creating VLANs also allows you to apply QoS or security policies to certain kinds of traffic, certain locations, or certain devices, or any combination. You can, for example, create a VLAN for students and one for teachers. The teacher VLAN may have access to servers or devices that students don't. You can restrict access by applying access control lists to the VLAN interfaces. NOTE: if you are not going to use access control lists, then separating students and teachers has very little practical benefit. In other words VLANs by themselves offer no security improvement.

So in your case, it may make sense to segment students and teachers (and servers), and use access lists to restrict access to the servers. You will need a way to identify teachers by which switchport they're plugged into, or by separate SSIDs for wireless.

Answer 2

The decision to use VLANs is a preference based on what you have for users, equipment, security, number of devices, data access, etc. As well as your available resources to support it. In this case your network is small enough that it can remain as one flat network with no vlan. An advantage to this is the lower cost due to not requiring the use of routers. You can get away with just layer 2 switches.

For security you could use one vlan for staff and one for students. However this will require a layer 3 switch at some point to handle internal routing. It will allow for breaking up the network into two different broadcast domains, however, if say the student network went down, it could go down for all students, so what does it buy you?

My personal experience would have me doing a single network here with a radius server for network authentication. Provide security on the servers through credential authentication. Firewall the internet connection into the school network. Keep it simple and easy to maintain.