Breaking up a flat network.

Unanswered Question
Jun 11th, 2009

Hi,

I'm looking for suggestions on breaking up a flat network. My current infrastructure is as follows:

192.168.0.0/23 (LAN)

150 Server IPs (approx)

75 Appliance IPs (switches/router/fw/printers)

240 Workstation IPs (90% dhcp)

As you can tell above this doesn't leave us with many available addresses and my group is preparing for additional growth that may use up the rest of the available IPs.

We have 5 network closets that terminate back to our core switch via fiber and gigabit is run to all server and workstations. There are up to 5 departments that terminate in each closet. All switches are VLAN capable, however, only the default is being used. Department will need to communication with one another.

I'd like to keep my servers on the existing subnet if possible, unfortunetly there are several applications (documented and undocumented) that point back to an ip address.

Also, i'd like to implement a separate vlan/subnet for Out of Band management.

Suggestions?

-Enable VLANs

-ReSubnet 192.168.0.0/22

-Configure each department with its own subnet

Thank you for your help!

nick

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Jon Marshall Thu, 06/11/2009 - 02:43

Nick

Firstly, which device are you proposing to use for routing between the vlans ? Do you have a L3 switch or router available ?

Personally i like to use /24's or /25's for subnets. I would definitely recommend using a separate vlan/subnet for each dept. as this will make it easier to apply policies such as acl's etc to each dept.

Out of band management means you would need extra kit unless you already have it spare. Even if you decided not to do out of band i would recommend having a separate vlan for management of the switches and not vlan 1.

Ideally you don't want to use vlan 1 for anything if you can help it but it's not a disaster if you do.

Jon

Joseph W. Doherty Thu, 06/11/2009 - 04:44

Beside what Jon has already suggested.

Don't see any reason why you can't continue to use your existing subnet for servers and other non-DHCP hosts. Just move your DHCP clients into a new address space, which could be further up the 192.168.0.0/16 address block.

Since you have multiple departments that terminate in each closet, you'll probably want to use VLANs, at least within the closet. Whether you want to extend those same VLANs into other closets is debatable. You could, or since you'll be routing, have closet/dept. subnets.

For your core device, a Catalyst 3750G-12S might be a good fit. Assuming your can bond Ethernet channels with your existing closet switches, a dual stack of these devices would provide redundancy. (BTW, the basic software IOS image should be fine.)

njfanelli Thu, 06/11/2009 - 05:04

Thank you for the replies.

We've noticed a significant amount of broadcast traffic on our switches.

Priorities:

#1 Reduce the amount of broadcast traffic

#2 Increase the amount of available addresses

Also, do I need a different subnet per vlan or can i use the same subnet for all vlans?

If I create a unique vlan for each department would i need to create acls to get the different vlans to talk to one another. OR do i create one vlan (aside of vlan 1 for management) for all clients that connect to that switch?

We are in the process of purchasing a catalyst 4500 for our core and catalyst 3560 and/or 2975 for our closets.

Thanks again for your help.

Joseph W. Doherty Thu, 06/11/2009 - 05:55

Moving from your flat network, to a routed network, is generally the way to contain broadcast traffic.

Normally you have one subnet per VLAN. You can have multiple subnets per VLAN, but usually don't want to have a subnet span VLANs.

No, you shouldn't need to create any ACLs to allow inter-VLAN communication. Their purpose is, generally, to block (some) communication. For instance, you might not permit other depts. to send to an accounting subnet yet allow the account subnet to send to other dept. subnets.

Unclear how you intend to use 3560 and 2975 in closets. If you wanted to route in closets, stack of 3750s likely a better choice. Plus if you route in closet, you'll also likely want an advanced IOS image on the 3560 unless you planned on only using statics or RIP.

The 4500 is a fine box, much depends on what you populate it with. For your size network, you might not need it, but again, it can be a solid choice.

If you have the budget for a hardware upgrades you describe, you might want to carefully consider the core/server relationship. My preference is, besides trying to get servers on the same "fabric", I like maximum bandwidth between them and the core. In smaller networks, this might be accomplished by combining the core/server on the same "fabric".

Since you mentioned gig connected servers, do note the original 4500 only supports 6 Gbps per slot. The -E version is much better at 24 Gbps per slot, but if you do consider combining core/server, you might also consider the 6500 which can provide up to 40 Gbps per slot.

Leo Laohoo Thu, 06/11/2009 - 20:47

Hi Nick,

Configuring InterVLAN Routing and ISL/802.1Q Trunking

http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a00800949fd.shtml

Configuring 802.1Q Trunking Between a Catalyst 3550/3560/3750 and Catalyst Switches That Run Cisco IOS Software

http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a008010f615.shtml

Hope this works for you.

Actions

This Discussion