Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am currently designing the network in my office, which is relatively small now but it plans to grow very fast. The design is pretty much done, the problem is occurring during the implementation. So the scenario is the following:

4 Subnetworks

  • with DHCP

and a DMZ network


One of the subnet has to have DHCP since is the one designed to host all the computers in the office. The hardware that we currently have is a firewall, that is our interface with the external network, this one has 5 interfaces one of which in getting the connection from the ISP.

Connected to this firewall there is then a layer 3 switch HP procurve 2650.

The point is that I don't know how to implement them. I have read around that I should also use VLAN, and it's fine but how can I connect the whole?

Moreover we have 2 Active Directory servers, which are part of the network, and the firewall that is also the default gateway has the address.

share|improve this question
PS I am new to this work – MixturaDementiae Aug 15 '12 at 11:46
So everything in the office right now will be connected to the same HP ProCurve switch, correct? – TopHat Aug 15 '12 at 11:53
Can you explain why you need this much initial complexity, especially when you're inexperienced in networking? Most LANs grow with a single /24 that serves them well for years, well into the 100 workstation territory. – gravyface Aug 15 '12 at 12:15
@MixturaDementiae but why all the additional subnets? I can see DMZ -- and that should be a built-in feature/network of your firewall -- but all those additional subnets just adds complexity and you'll have your hands full just managing a single /24 network. – gravyface Aug 15 '12 at 12:25
Forget the future for now. Do it (apart from the DMZ) with one subnet. It really isn't hard to expand it later if the need arises. – John Gardeniers Aug 15 '12 at 12:48

1 Answer 1

up vote 5 down vote accepted

If you are not an experienced admin, setting up a brand new network with multiple subnets and VLANs is going to be very challenging.


First off, let's explain VLANs. In very basic terms, setting up VLANs on your switch partitions it into several separate switches. So if I take a 48 port switch, I could setup two VLANs and have the equivalent of two 24 port switches.

Some firewalls will also support VLANs, and can be setup so it can talk to several different VLANs through a single interface, instead of having to run multiple cables. The documentation for your firewall should tell you if this is possible and how to set it up.


Each subnet (that wants to communicate outside of that subnet, to others or two the internet) will need a default gateway inside that subnet. So your firewall will actually need to have IP addresses like,,, and

Communication between the subnets can ONLY take place through the default gateway, so all traffic between subnets will be going through your firewall. This can be a good thing, if you need to filter traffic between them, or a bad thing if your firewall is slow and becomes a bottleneck.

Instead of segmenting the network like this, I'd strongly recommend using fewer, larger subnets. Start off with one for servers, and one for clients. If you think you will grow quickly, use /16 subnets instead of /24. You can still choose to use specific ranges for specific purposes.


If you use a /16 network, say, you can give all your server equipment addresses in the range and setup DHCP to hand out addresses in Since they are all on the same subnet, they can communicate with each other easily. Later on, if you start running out of DHCP addresses, you can simply start handing out DHCP addresses in the range, without having to reconfigure ANYTHING.

Down the road, when you expand, have a bit more experience, and decide you need some servers to be isolated from the rest of your network, you can setup another interface on the firewall, and start using another range like for those systems. Then setup VLANs, or get a second switch. That is easy to add later. If you don't need it now, I wouldn't start with it. The more complicated you make your network, the harder it is to troubleshoot.

If you really want to be clever, when you pick which address ranges to use for different purposes, choose ones that can easily be subnetted later, so you only have to change the subnet mask on everything if you want to isolate them. That tends to be an easier task than changing server IP addresses.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.