Aha well this is where it gets interesting. Yes IP addressing is a good question.
FIrst on the vlan biz - when you add vlan 30 to 6509 then if automatically all other switches will be able to tap into it. this is becuase you have previously setup trunking.
now on the IP addressing. since you have indicated that people travel from building to building then your IP design is no longer based on building premise but on a vlan premise. that means each vlan will have its own dhcp server. you agree that if an accounting staff who lives in building #1 logs into building #2 jack and we have a paper-CCIE setup where each building has its seperate subnet, then we have violated the main concept of <> = subnet
what we want is that the accounting staff gets IP address from the vlan that he/she belongs to NO MATTER where that person is geographically.
to accomplish that I suggested the vlan design. ok so no dhcp per buidling which means each building can have people with totally different net numbers. why? because of their different department.
no how do this? one would think we need dhcp for each vlan, probably living at the 6509 site. yes and no. Microsoft dhcp has proven wonderful. I have one dhcp server for all vlans, how? whatever the device is which is routing between vlans, say RSM may be in your can, you setup a dhcp helper agent on each virtual interface that faces each vlan. that agent forwards the dhcp to your Microsoft DHCP server. Your MS server has multiple scopes.
Now to the million dollar question - how does it know to pick from the correct scope. Well it does because the dhcp forwarding configuration (this is just cisco config on the rsm) ebmeds the net number where that virtual interface lives. Then Microsoft uses it to pick from the correct scope.
Yes, I didnt beliebe this until I saw it working
Lastly, if anyone is just jumping in on this, one will ask - well how does the accountant becomes part of his/her vlan when visiting other buildings - this is exactly what binoy will have to figure out with 802.1x authentication. once authenticated the acountant's port will be dynamically joined into the VLAN # that IAS has returned back to the user. How IAS knows, well its mapped statically (member of group==vlan id) withint IAS config based upon some other criteria such as group memberhip, or some other monkey active directory attribute. user setds 802.1x, radius chats with IAS, user is auth, port is joined to vlan xxx, only then does the user go into dhcp business and finally gets an ip address which the dhcp agent listening to that vlan virtual interface forwards to Microsoft server dhcp and it picks the correct scope. Then the accounting staff is on the accounting vlan - all accounting servers are reachable on the same IP network (doesnt go across routers) although the physicall devices may be in other buildings - this is layer 2 trunking business and not visible to IP.
we have then accomplished the objectives.
~boyan
May you share what did you pay for the 6509 and what guts did it come with, you know super, blades, power, even the plastic cable mgmt plates? I'm planning a mass upgrade but still want to shelter budgeting people from having a hard attack when they see the dollars. Just FYI: I am runing 55xx platform across the bord and all testing described here is based upon this setup.
