How to create a subnet or secondary network? Do I need VLANs?

Question

I am not new to IT, but in the past, I've always had a Network Admin to handle this type of stuff. That being said I know just enough to be dangerous.

---

What I have is an old hodgepodge of different technologies that were all purchased before my time and thrown in together with a wish and a prayer. Now I'm trying to make sense of it all and make it better for our users and myself.

I'm not sure what information you will need to assist me but I'll provide as much as I am able, if I've missed something that would help in figuring this out let me know and I'll update the question.

---

We currently have:

9 UniFi Network UAP-AC-Pro Gen2

They have 2 working SSIDs both on the same business network, a Management SSID that is supposed to be on a separate network, and a Guest SSID that is supposed to be on yet another network. All 4 SSIDs are on the same network.

6 Extreme Networks WiNG Wireless AP8432

They all have 1 SSID, it is on the same network as the UniFi APs and should be as they are mirroring one of the 2 SSIDs that are working.

1 Extreme Networks Universal Wireless AP305C

This matches the other 6 from Extreme it was purchased more recently and was cheaper than the new version of the WiNG Wireless APs.

1 Aruba IAP-207

This has 3 SSIDs, and they all work. 1 business, 1 manager, and 1 guest are all separate networks controlled by the AP itself.

These are all connected to various switches throughout the plant.

There are:

• Cisco C2950
• Extreme X440G2
• Extreme 210
• HP ProCurve 1800 / 1820
• Plus a bunch of unmanaged 5-24 port switches mostly Linksys and D-Link

Networks: Just 1 business network. No subnets, no VLANs.

We are running out of IPs very quickly and I would like to alleviate the stress by creating a separate subnet or network or VLAN (or something) for different things like printers and cameras.

It seems like it should be simple enough, but I can't afford to break our network.

EDIT

Sorry I was not clear in the original question. I want to know how to create a subnet. I have used a subnet calculator that made it seem like I can create any number of subnets, but I don't know how to actually create them or where.

So my questions are:

1. How and where do I create the subnet?
2. How do I ensure that the subnets can communicate so that when I move printers to it we can still print?
3. I have a Cisco 2950 and a Cisco 2950sx switch, they are both old and only 10/100, is that good enough to create the subnet? Or do I need something better, like a switch with 1g speed since that is what the rest of the network is using?

EDIT 2 Network Diagram

Hopefully, this helps. I am trying to show how much stuff is jumbled together. There are a bunch of different things connected to each switch, laptops, desktops, printers, AP, Cameras, unmanaged switches, some lab equipment too. I just put this together now because we don't have one otherwise.

Is this enough detail?

Current IP Address ranges:

• 10.0.0.1-99 set aside for static assignment(5 remaining)
• 10.0.0.100-254 DHCP address pool (10-40 remaining depending on personal devices on the network)
• 10.0.1.1-254: Lab Intranet not connected to the business network or internet. This isn't really a subnet because it's not connected to anything else, but I don't want to use this IP range in making a subnet so there isn't any confusion later.

I would like to add subnets:

• 10.0.2.1-254 for printers
• 10.0.3.1-254 for cameras
• 10.0.4.1-254 Guest Wi-Fi access

If you could explain how to set up the first one for the printers I can then go off of that to create the others.

EDIT 3 - Network Explanation

We have just one network. We have 4 types of AP from 3 different brands.

• The Extreme APs (both types) are only broadcasting one SSID. This SSID is used for Mobile Device Scanners that connect to our ERP system.

SSID: WMS

• The Aruba AP has 3 SSIDs, including the same one as the Extreme APs.

SSIDs: WMS, Management, Guest

The SSIDs WMS and Management are on the same network they are just different names, there isn't really a reason for this other than it was like that when I got here and I've not fixed it yet.

The SSID Guest uses Aruba's built-in client management system in the virtual controller to grant a separate IP range. It appears to be using 10.0.10.1-254 as its built-in range.

• Unifi APs, have 2 SSID (the guest SSID doesn't work because there's no VLAN for it to use so it's currently turned off till I get this figured out.) They are the same 2 as Aruba and are on the same network with the same IP range.

SSIDs: WMS, Management

The SSIDs WMS and Management again there isn't really a good reason for these to be separate since the only difference is the name of the SSID.

EDIT - Add Firewall

The firewall we have is a FortiGate 60F. This is managed by our parent company in another country.

Answer 1

As has been pointed out in the comments, that's quite a "grown" network with little structure. However, unless you're out of switch ports you don't seem to need additional hardware.

Things to improve:

• You should select a "core" switch and rewire so that all other switches, WAPs, the firewall etc. connect to that core switch. Chaining switches is generally not recommended, you should stick to a tree structure. The switch should be your best model with layer-3 switching, so an X440G2 would be reasonable.
• You shouldn't have client ports on that switch but you can connect servers to it. If you do need to mix, make sure you separate port ranges clearly, e.g. 1-16 for core, 17-48 for clients.
• If you need redundancy within the network you need two core switches and all other important switches/devices connected to each one - I'm not going into that here as there's enough to do already.
• Before any large changes you should make up your mind if there are any additional security zones you need to map.
• The different networks on the Aruba IAP need to be sorted out - how are they separated? Where are the rulesets to separate them?

How and where do I create the subnet?

An IP subnet is actually created by any node using one of its addresses. However, for communication and DHCP to work, you'd need to set up VLANs to match the IP subnets.

Also, you need to connect a router to each subnet/VLAN - either the Fortigate or an X440G2. VLANs need to be set up on each participating switch and all switches in between. Between each pair of switches/routers you configure a VLAN trunk - you tag each VLAN that runs across (one of the VLANs may remain untagged but configurations on both sides need to match). That way, a single physical link can carry all your VLANs.

Each router/L3 switch needs to be made aware of any IP subnets/VLANs that aren't connected to them directly. You can add static routes for that (your network isn't really large) or configure a routing protocol like OSPF with all routers, if supported.

That making aware includes your parent company's upstream router (I'm assuming there's some VPN set up for mutual access). Check with them whether that's OK, how to do it and clear your IP address plan with them! Without VPN, you're likely free to choose any address scheme.

How do I ensure that the subnets can communicate so that when I move printers to it we can still print?

Clients have a printer configured either by IP address or by DNS name. A DNS name points to the actual IP address, allowing you to change a single record to make all clients find a relocated printer. However, we cannot help you with setting that up as device configurations and protocols above the transport layer are off-topic here.

I have a Cisco 2950 and a Cisco 2950sx switch, they are both old and only 10/100, is that good enough to create the subnet?

Unless you're fine with limiting all devices to those switches to 100 Mbit/s, you can't really use those.

All in all, you should make up your mind whether you're up to the task. You should understand the basic concepts of IP subnetting, routing, switching and VLANs. Study the manuals, learn about the differences between your devices, and we can probably help you making them work together.

To start with, you could create a VLAN on two adjacent switches, add it to their interconnecting ports as tagged (creating a trunk), add a previously unused port as untagged on each and connect two clients to the untagged ports - they should be able to 'see' each other. Note that you need to manually configure static IP addresses absent a DHCP server.

Using the same method (tagged VLAN over interconnect), expand the VLAN to the router. Configure an IP, a simple ruleset to permit talking to other subnets. Set the router IP as default gateway on the clients. Voilá - you've started virtualizing your network!