Splitting network between guests and production clients

Question

I'm sorry, if there is already answer for this question, but it's some sort of question, that is hard to find by yourself, that's why I'm asking it.

I've got a task, to split one, pretty big company network, into smaller one. The main reasons, why it's needed are:

• it's not safe to expose production machines
• guests devices often interfere with production machines, since they are in the same network
• the whole network is running out of addresses
• the network is badly organised and it's hard to tell, what is going on inside it

The network was made about 15-20 years ago and it evolved by itself to this state. The network address is 192.168.1.0 and the mask is 255.255.255.0. Main devices, like switches, servers, router etc. are on low addresses (192.168.1.1-50). There is Microsoft DHCP server and the router is running on Pfsense. Production machines are on somewhere around 230. It is not possible to change the addressation on machnies, so they have to stay as they are.

The main idea is to split it to 2-3 smaller networks. One for office computers and guest devices. The second would be for production machines. Also there are a lot of devices like printers, Active Directory server, production computers etc. that should be able to access from both networks or have access to both networks. Some employees also want to access the remote view on some machines, so something like a port forwarding is needed.

I was thinking about port aggregation, spliting it with router, adding VPN or trying something with just vlans. Still I cannot see the most optimal way to do it.

Since it isn't probably the most atypical task to do, I think that there is a simple solution for this.

Could you please give me some tips, on how it can be solved? Every solution may take a lot of time to implement into life, so firstly I want to plan it as good as it's possible.

Answer 1

Whenever I've had to do something like this, I normally use a number of phases:

• Emergency phase: simply expanding the netmask and going to, say, 192.168.0.0/23, with a shameful secondary address on the main router
• DHCP phase: Requiring all new systems to be DHCP, with static allocations for servers, printers, and similar
• VLAN phase: moving desktop/laptops, a few a day, to a new VLAN
• Fixup phase: remove whatever shameful things got done on the way

Answer 2

Your question is almost too broad for this site, but I will give you some general advice.

I think that there is a simple solution for this.

There is no simple solution for this; you need a complete network redesign, with an eye toward flexibility. You should always design in flexibility and growth. You should always plan for ten times growth. If you feel inadequate for this, you should really consider using consultants to help design the new network.

You probably do not want to split the existing address range. That will require changing the network mask and gateway on the end-devices, something that you seem to not want to do. Not being able to readdress devices is a huge problem. DNS and DHCP solved that problem many years ago, and if you are using specific addresses, rather than DNS, then you are doing it incorrectly. Using DNS allows you to readdress with very little pain.

You probably want to add more networks. You can do that with VLANs, or with completely separate links from the router. Place ACLs between the networks to restrict things. For example, you probably do not want the guest network to have access to the production network, and you do not want guests on the same network as your employees. (Many companies are now outsourcing guest networks because of the legal ramifications of guests using the network for illegal activities.)

Come up with a plan for your networks. Decide how many networks to start, and what each is for. Create addressing for each network. If you need the networks to share the same access switches, then you need to use VLANs, and you need to see if your existing equipment can do that.

You need good information on traffic flows. Designing a network without understanding where traffic flows, and how much traffic there is, is a very, very bad idea. There are tools for that. NetFlow (IPFIX) is built into many network devices. You must consider bandwidth oversubscription. Cisco recommends no more than a 20:1 access to distribution oversubscription ratio. That means that for every 20 access interfaces, you have the equivalent of one access interface in the uplink. For example, an access switch with 48 gigabit interfaces would need at least 2.4 Gbps as an uplink to the distribution. Also, the recommendation is for no more than a 4:1 distribution to core bandwidth oversubscription.

There are many best practices. For example, having a guest network means that you really need to pay attention to security best practices, especially layer-2 security. For example, don't use VLAN 1 or a native VLAN, and disable as many layer-2 protocols (CDP/LLDP, HSRP/VRRP, etc.) as possible because they are security weaknesses. You may want to consider separating your guests with a firewall.

Some best practices are around preventing things like spanning tree loops that can bring your network down and are hard to resolve. A current best practice is to not let a VLAN span multiple access switches. You can have multiple VLANs on an access switch, but those VLANs do not extend to other access switches. You should also not connect access switches to each other, only to distribution switches, which should not have any access interfaces on them. Many companies are headed toward layer-3 to the access switch, and that will prevent any spanning tree problems. You still enable spanning tree as a failsafe, but you don't depend on it.

As you can see, the topic is really too broad to give a complete treatment here.

Answer 3

Seconding Ron's suggestions for renumbering - just subnetting will create a dead end when the net grows further.

Another good intermediate step in addition to jonathanjo's advice when everything is locally configured with static addresses:

1. reserve all static IP addresses on your DHCP server (a simple ARP scan can generate a MAC/IP list)
2. reconfigure all (non-vital) static devices to DHCP, making them keep their previous address
3. before renumbering, reduce the lease time to a short period (1 h or so) and wait for leases to renew with the short period
4. change the scope/reservations on the DHCP server to renumber
5. you can usually force a DHCP lease renew by toggling the client's uplink port

When you're worried about DHCP server failure set up a backup server or failover.

Answer 4

IMO you should follow two key principles.

1. Don't let perfect be the enemy of good.
2. Have a plan for where you are going and how you are going to get there.

---

IMO the first thing you need to do is look at your hardware and upgrade it if nessacery.

1. All switches should support VLANs and traffic volume monitoring.
2. All APs should support mapping VLANs to SSIDs.
3. Your router should be flexible and have sufficient performance. Whether you are better off with a server acting as a reouter or with something from the likes of cisco will depend on your traffic levels and available expertise but what you certainly don't want is a "home/SMB router".
4. You should have plenty of spare bandwidth. As you split the network up into VLANS previously local traffic may start flowing via your router.

---

The second thing to do is to get the guests off your main network onto another VLAN/SSID. This will free up address space and allow you to place firewall rules between the guest network and the main network.

---

After that you can start thinking about your main network. Is it a hard requirement that no addresses change or are there just certain machines that need to retain there address. If you absoloutely have to then it is possible to use proxy arp and /32 routes to split a network into VLANs without readdressing but the pain of proxy arp may well be greater than the pain of readdressing.