5

I've recently been tasked with cleaning up an old network in where no passwords were provided, I was able to get in and look at the config. I've decided to replace 3 switches and add some new vlans in order to help organize things a bit better. All Devices are Static, no outside access needed. Switches are all HP. Area on the right has all HP2920s along with an HP fiber switch at the head end. Area on the right has a mix of HP2520s and HP2530 and all are layer 3. Both areas are connected with fiber.

Network Diagram

Stuck on trying to figure out how I can take the existing equipment and move it to the new vlans while keeping it all up and running. All static devices land back to 4 server with Dual NICS, one NIC has the management vlan (1) while the other NIC is for one of the legacy vlans (5). I would be using vlan 9, 10 one for each server based on the area of the device but won't be moving all the devices right away. I thought about inter vlan routing, but unsure of how to go about that? would one of the switches need to have the routing information to tell the others how to route betwhttps://networkengineering.stackexchange.com/editing-helpeen vlans?

default gateway: 192.168.100.1 (currently). vlan 1: 192.168.100.10-30 (for http access of switches). vlan 2: no IP. vlan 3: no IP.

Added VLANS
vlan 9: 192.168.9.1
vlan 10: 192.168.10.1
vlan 11: 192.168.11.1

  • Can't you just assign the new VLANs to the switches, just like the old VLANs, alongside the current VLANs, without assigning any interfaces to the new VLANs? – Ron Maupin Jul 26 '18 at 0:47
  • HPE 2520 and 2530 series are layer-2 switches. – Zac67 Jul 26 '18 at 4:30
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:05
1

trying to figure out how I can take the existing equipment and move it to the new vlans while keeping it all up and running.

If you want to have the VLANs communicate with each other this isn't possible (edit: in a sane manner). You'll need to migrate the IP addresses of the nodes changing the VLAN and accordingly, the IP subnet. Migration needs to be done manually with static addresses or, using a DHCP server, by reducing the lease time to a short period in advance, changing the VLANs and letting the DHCP clients pick up their new IP address.

Without any inter-VLAN communication you can just move the desired ports over to the new VLAN. Add the VLANs to the desired switches first and configure the trunks accordingly. Last, move the ports over - while you're doing this, L2 connectivity will be temporarily broken.

I thought about inter vlan routing, but unsure of how to go about that? would one of the switches need to have the routing information to tell the others how to route between vlans?

For inter-VLAN communication you'll need a router or one of the 2920 switches to route between them. Since there's no redundancy in your network layout, one of the topmost switches(?) comes to mind. Depending on your performance requirements, the fiber link might require 10 Gbit/s.

Given the size of the network I'd use static routes - with a single router/L3 switch, all VLANs should be connected there and no additional routes are required. The 2920s can also use OSPF or RIP to propagate routes. The other switches operating at L2 don't need any routes except the one out of the management VLAN.

Make sure you inhibit unwanted inter-VLAN communication on the router/L3 switch, e.g. by using ACLs.

  • 1
    You say this isn't possible, but that isn't entirely accurate. It is possible if necessary, just really ugly. Combinations of (im)proper configurations, DNS/host files, static ARP entries, static routes, and proxy-ARP while cross connecting VLANs with access ports could allow what the OP asked. It would just be terribly messy, unstable and a nightmare to manage correctly and getting it wrong will be more disruptive than just migrating everything. Far easier (i.e. less work and less knowledge required) to bite the bullet and schedule downtime to get this done. – YLearn Jul 26 '18 at 5:13
  • 1
    Absolutely, but I didn't want to go into that and I definitely can't recommend going there... – Zac67 Jul 26 '18 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.