0

I am not new to IT, but in the past, I've always had a Network Admin to handle this type of stuff. That being said I know just enough to be dangerous.


What I have is an old hodgepodge of different technologies that were all purchased before my time and thrown in together with a wish and a prayer. Now I'm trying to make sense of it all and make it better for our users and myself.

I'm not sure what information you will need to assist me but I'll provide as much as I am able, if I've missed something that would help in figuring this out let me know and I'll update the question.


We currently have:

9 UniFi Network UAP-AC-Pro Gen2

They have 2 working SSIDs both on the same business network, a Management SSID that is supposed to be on a separate network, and a Guest SSID that is supposed to be on yet another network. All 4 SSIDs are on the same network.

6 Extreme Networks WiNG Wireless AP8432

They all have 1 SSID, it is on the same network as the UniFi APs and should be as they are mirroring one of the 2 SSIDs that are working.

1 Extreme Networks Universal Wireless AP305C

This matches the other 6 from Extreme it was purchased more recently and was cheaper than the new version of the WiNG Wireless APs.

1 Aruba IAP-207

This has 3 SSIDs, and they all work. 1 business, 1 manager, and 1 guest are all separate networks controlled by the AP itself.

These are all connected to various switches throughout the plant.

There are:

  • Cisco C2950
  • Extreme X440G2
  • Extreme 210
  • HP ProCurve 1800 / 1820
  • Plus a bunch of unmanaged 5-24 port switches mostly Linksys and D-Link

Networks: Just 1 business network. No subnets, no VLANs.

We are running out of IPs very quickly and I would like to alleviate the stress by creating a separate subnet or network or VLAN (or something) for different things like printers and cameras.

It seems like it should be simple enough, but I can't afford to break our network.

EDIT

Sorry I was not clear in the original question. I want to know how to create a subnet. I have used a subnet calculator that made it seem like I can create any number of subnets, but I don't know how to actually create them or where.

So my questions are:

  1. How and where do I create the subnet?
  2. How do I ensure that the subnets can communicate so that when I move printers to it we can still print?
  3. I have a Cisco 2950 and a Cisco 2950sx switch, they are both old and only 10/100, is that good enough to create the subnet? Or do I need something better, like a switch with 1g speed since that is what the rest of the network is using?

EDIT 2 Network Diagram

ERL Network Diagram

Hopefully, this helps. I am trying to show how much stuff is jumbled together. There are a bunch of different things connected to each switch, laptops, desktops, printers, AP, Cameras, unmanaged switches, some lab equipment too. I just put this together now because we don't have one otherwise.

Is this enough detail?

Current IP Address ranges:

  • 10.0.0.1-99 set aside for static assignment(5 remaining)
  • 10.0.0.100-254 DHCP address pool (10-40 remaining depending on personal devices on the network)
  • 10.0.1.1-254: Lab Intranet not connected to the business network or internet. This isn't really a subnet because it's not connected to anything else, but I don't want to use this IP range in making a subnet so there isn't any confusion later.

I would like to add subnets:

  • 10.0.2.1-254 for printers
  • 10.0.3.1-254 for cameras
  • 10.0.4.1-254 Guest Wi-Fi access

If you could explain how to set up the first one for the printers I can then go off of that to create the others.

EDIT 3 - Network Explanation

We have just one network. We have 4 types of AP from 3 different brands.

  • The Extreme APs (both types) are only broadcasting one SSID. This SSID is used for Mobile Device Scanners that connect to our ERP system.

SSID: WMS

  • The Aruba AP has 3 SSIDs, including the same one as the Extreme APs.

SSIDs: WMS, Management, Guest

The SSIDs WMS and Management are on the same network they are just different names, there isn't really a reason for this other than it was like that when I got here and I've not fixed it yet.

The SSID Guest uses Aruba's built-in client management system in the virtual controller to grant a separate IP range. It appears to be using 10.0.10.1-254 as its built-in range.

  • Unifi APs, have 2 SSID (the guest SSID doesn't work because there's no VLAN for it to use so it's currently turned off till I get this figured out.) They are the same 2 as Aruba and are on the same network with the same IP range.

SSIDs: WMS, Management

The SSIDs WMS and Management again there isn't really a good reason for these to be separate since the only difference is the name of the SSID.

EDIT - Add Firewall

The firewall we have is a FortiGate 60F. This is managed by our parent company in another country.

11
  • 1
    What exactly is your question? To create a subnet you just do that - you can use a VLAN or a separate switch, put a router in between the old and the new, done. You could use the X440 as L3 switch for that. We can help you with that but we cannot design your network for you, however.
    – Zac67
    May 6 at 20:03
  • @Zac67 sorry for my lack of clarity in what I was asking. I have added an edit. I am not sure what information is needed to create a subnet so I added what I thought would help in the original question. I have added 3 questions that I am hoping I can get answers to, or directions on where I can find answers to them. Thank you for any help that you can give.
    – Mike
    May 9 at 15:05
  • It would be helpful if you added a simple diagram. You can create another subnet on the X440, but we can't go into any more detail without a better understanding of how everything is connected. Also include your current IP addresses.
    – Ron Trunk
    May 9 at 15:13
  • 1
    Given your circumstance, you may have to create the additional subnets on your firewall (you don't mention the model), and trunk multiple VLANs throughout your network. This is not ideal, but the alternative would be to rewire your entire network.
    – Ron Trunk
    May 9 at 17:57
  • 1
    That's quite a "grown" (read: weird) setup. Your (more or less) central switches are HPE 1800 and 1820, the weakest models around. I'd seriously suggest a complete redesign and you should consider hiring a consultant for that. Since the FGT-60F is administered from elsewhere, do they support your efforts (especially setting up routes)? Without that, you're options are seriously limited.
    – Zac67
    May 9 at 18:09

1 Answer 1

2

As has been pointed out in the comments, that's quite a "grown" network with little structure. However, unless you're out of switch ports you don't seem to need additional hardware.

Things to improve:

  • You should select a "core" switch and rewire so that all other switches, WAPs, the firewall etc. connect to that core switch. Chaining switches is generally not recommended, you should stick to a tree structure. The switch should be your best model with layer-3 switching, so an X440G2 would be reasonable.
  • You shouldn't have client ports on that switch but you can connect servers to it. If you do need to mix, make sure you separate port ranges clearly, e.g. 1-16 for core, 17-48 for clients.
  • If you need redundancy within the network you need two core switches and all other important switches/devices connected to each one - I'm not going into that here as there's enough to do already.
  • Before any large changes you should make up your mind if there are any additional security zones you need to map.
  • The different networks on the Aruba IAP need to be sorted out - how are they separated? Where are the rulesets to separate them?

How and where do I create the subnet?

An IP subnet is actually created by any node using one of its addresses. However, for communication and DHCP to work, you'd need to set up VLANs to match the IP subnets.

Also, you need to connect a router to each subnet/VLAN - either the Fortigate or an X440G2. VLANs need to be set up on each participating switch and all switches in between. Between each pair of switches/routers you configure a VLAN trunk - you tag each VLAN that runs across (one of the VLANs may remain untagged but configurations on both sides need to match). That way, a single physical link can carry all your VLANs.

Each router/L3 switch needs to be made aware of any IP subnets/VLANs that aren't connected to them directly. You can add static routes for that (your network isn't really large) or configure a routing protocol like OSPF with all routers, if supported.

That making aware includes your parent company's upstream router (I'm assuming there's some VPN set up for mutual access). Check with them whether that's OK, how to do it and clear your IP address plan with them! Without VPN, you're likely free to choose any address scheme.

How do I ensure that the subnets can communicate so that when I move printers to it we can still print?

Clients have a printer configured either by IP address or by DNS name. A DNS name points to the actual IP address, allowing you to change a single record to make all clients find a relocated printer. However, we cannot help you with setting that up as device configurations and protocols above the transport layer are off-topic here.

I have a Cisco 2950 and a Cisco 2950sx switch, they are both old and only 10/100, is that good enough to create the subnet?

Unless you're fine with limiting all devices to those switches to 100 Mbit/s, you can't really use those.

All in all, you should make up your mind whether you're up to the task. You should understand the basic concepts of IP subnetting, routing, switching and VLANs. Study the manuals, learn about the differences between your devices, and we can probably help you making them work together.

To start with, you could create a VLAN on two adjacent switches, add it to their interconnecting ports as tagged (creating a trunk), add a previously unused port as untagged on each and connect two clients to the untagged ports - they should be able to 'see' each other. Note that you need to manually configure static IP addresses absent a DHCP server.

Using the same method (tagged VLAN over interconnect), expand the VLAN to the router. Configure an IP, a simple ruleset to permit talking to other subnets. Set the router IP as default gateway on the clients. Voilá - you've started virtualizing your network!

7
  • This does seem to be more than what I can handle personally without outside help. I think that I can rearrange the network a little to make one of the HP 1800 switches the core, but the X440 are too far removed physically for one of them to work. Can one of the HPs be used to create the VLANs? Or are they not good enough either? I know they are low end.
    – Mike
    May 10 at 13:50
  • 1
    Technically, all your switches support VLANs (with very different configuration methods), so there's nothing stopping you. Note that all switches between any nodes from the same VLAN need to be configured for the VLAN though, and you'll need to trunk the VLANs using tags between the switches. I'd seriously recommend starting with a single switch for practicing, and then expand that VLAN to a second, and subsequently more switches. It may be necessary to experiment with each switch type by itself before running trunks. VLANs aren't that complicated but may feel strange when you're new with them
    – Zac67
    May 10 at 13:58
  • Once you feel comfortable and see everything working - especially VLANs spanning multiple switches and routing between VLANs -, you can start migrating productive users.
    – Zac67
    May 10 at 14:08
  • For trunks, does there have to be a physical cable going from one switch to the other with both ends tagged for that particular VLAN? Or is the trunk a logical thing that I have to program into both switches like the VLAN?
    – Mike
    May 10 at 14:33
  • 1
    If you tag multiple VLANs on a physical link you create a VLAN trunk. On some switches (Cisco) you configure a switch port as trunk that carries all VLANs as tagged by default, and on other switches (Extreme, HPE) you add VLANs one by one as tagged (or untagged for a maximum of one VLAN) to a physical link.
    – Zac67
    May 10 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.