Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

designing VLANs and need a little help?

HI guys,

I am about to design VLANs in our environment, Active Directory 2003 servers, about 100 users, many server and a very complex network supporting our online but educatinal business. I do not support the servers but the Network infrastructure consisting of few routers 2621 and 2611, one core Cisco CAT 4500 (Cisco IOS), two 4006 CAT with CAT IOS and few 3560s and 3550s switches. Currently I have two VLAN but I am not doing trunking in fact, I inheritted the network this way one subnet on one VLAN and the other on a different VLAN but the two subnets are physically seprated (I don't know why they created VLANS to begin with given what I just explained above!).

The guys supporting the AD are opposing the VLANs fearing of IP re-numbering and I really don't know how and where to start in this "Chaos" situation. can I do layer two VLANs only not needing to do any renumbering of IP and keep the AD guys happy?

what would be the best scenario as far as servers are concern? should they be on different VLANs? if yes, how can I make sure that our users have the same network access as far as resources access on those servers?

I want to have the two floors of our company separated by routers, i.e. one router for each floor and have trunking between them and the switches. Any suggestion is welcom.

Thanks guys,





Re: designing VLANs and need a little help?

The AD guys fear renumbering due to DNS/WINS issue. Every installed server has to have these entries entered mannually. On the other hand, they would have to renumber all servers anyways.


1. It is a good idea to separate servers from users.

2. You don't have to renumber servers, but then you should leave their network in the new VLAN you'd assign to them

3. VLANs are not bound to L3 Addresses - they are on different layers.

4. Watch out for applications - some of them access resources using DNS name, but others use hard-coded IP (bad programming, but what are you gonna do).

5. All resources should be available to users after you would separate VLANs - just make sure routing works.

6. Make sure you are not running other protocols - like IPX, since when users are on the same VLAN as servers you don't really have any control.

7. Some servers might use "back-end" interfaces to access other servers on local network. You should not separate them.

8. Some servers run in clustered mode using unicast/multicast.

Basically there is a lot of stuff to look for.

From what you wrote it's impossible to determine even the basic vlan division, except that USERS+AD should be separated from online business.

New Member

Re: designing VLANs and need a little help?

Hey Thanks, I really know, its very difficult and this may of have been why those incharge of Network Infrastructure devices left these VLANs they way they are now.

few points:

You wrote:

7. Some servers might use "back-end" interfaces to access other servers on local network. You should not separate them.

This is actually one of my concerns since we are doing NAT but some of the servers (usually, Web Server, Test Server, development Server, etc) have two NICs, one with private address and the other Public Ip Address. What should I be doing for these servers, understanding that all the servers will be and must be on their own VLAN?

Also, the "back-end" interfaces, yes, you are right and thanks for pointing out. Is this the situation where one Interface has private and the other has Public?

and how about teh Clusters? how should that be habdeled?

I understand that I realy have a lot of working to do and I have already stated working on the layout and "Things that we look for before touching anything at all"..



CreatePlease to create content