Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm changing my network from having every device on flat network to using VLans. My problem is that we already have a lot of devices on this network( From theory, I read that each Vlan has to be a different subnet and then I need to configure virtual interfaces on my Cisco router to cater for inter vlan routing.

1) How can I segment this network with minimum down time on the devices already on the network?

2) Can I just create Vlans and leave all these Vlans in the same layer 3 network so that they can go out of the network (I am not too concerned about inter-Vlan routing) or I have to create subnets which means reconfiguring the existing devices (something I do not want).

share|improve this question

migrated from Sep 20 '12 at 15:59

This question came from our site for information security professionals.

A poor understanding of what VLAN's are and how they fit into a larger security context + not having specific reasons and objectives for implementing said VLAN's from a security perspective = Failure. Making the statement "I am designing my network to improve security" is like making the statement "I want to be a better person". There's no context from which an answer can be formulated. – joeqwerty Sep 20 '12 at 16:06
I removed the security wording from this. The question of security of VLans is something we can discuss on Security.SE (or here), but not in the same question as the implementation / how to do it with limited downtime. I focused this question to the latter. – Jeff Ferland Sep 20 '12 at 17:30
After reading voretaq7's anser, if you decide to pursue VLAN's further, do yourself a favor and learn the difference between tagged and untagged. A lack of understanding can lead to much frustration. – Luke Sep 20 '12 at 18:01
@Luke Good point - I didn't get into Tagged/Untagged (and Tagged ingress/Untagged egress, or vice-versa) - I also avoided discussing the differences between 802.1Q vLAN tagging (which is what most people mean when they say "vLAN") and "port-based vLANs" which are less flexible and generally sucky. – voretaq7 Sep 20 '12 at 18:22
up vote 25 down vote accepted

As Joeqwerty already noted, you're approaching this with an inadequate fundamental understanding, combined with vaguely-defined goals. You are setting yourself up for failure, downtime, and security holes. Rather than just answering your questions as asked I'm going to indulge in a little "vLAN 101" tutorial which might be a bit more useful for you.

You seem to have a few fundamental misconceptions about vLAN segmentation and how it fits into network architecture, so let's roll ALLLLLLL the way back to the beginning for a minute:

From a network architecture level you can take the very simplistic view that a vLAN is nothing more than a separate switch, not connected to any other switch (vLAN).

If you look at vLANs in this way it becomes relatively clear how to use them: When you don't want machines in Group A to be able to talk to machines in Group B you put them in separate vLANs, and force them to traverse a router (ideally one with firewall functionality) to talk to each other.
Under nearly all circumstances it's better (and easier) to do this by also putting the machines in different IP networks (subnets) -- Machines within a vLAN are in the same subnet, and can chat amongst themselves as much as they want, but if they want to talk to someone outside their vLAN it's also going to be outside their subnet, so they get handed off to their default gateway, which can handle the security concern of who can talk to whom under what circumstances.

So vLAN architecture in 11 easy steps:

  1. Figure out which machines form logical groups. These are your vLANs
    In a very simple environment this could be Web Servers and Database Servers.
    In more complex environments you may have lots of groups, and you may combine multiple groups in a single vLAN -- This is an architecture decision you have to make.

  2. Figure out an addressing scheme that suits your vLANs.
    If you're supremely lucky every vLAN will fit into a /24 and you'll be able to build a topology based around that. If you aren't that lucky figure out which vLANs need bigger (or smaller) blocks.

  3. Draw what you have done so far on paper.

  4. Figure out which vLANs need to talk to each other.
    What ports/services should be open between vLANs/Networks?
    What other conditions need to exist for your environment to function?

  5. Draw what you came up with on paper. Make sure it's sane, then convert it into firewall/router policy.

  6. Draft a firewall/router configuration. Ideally play with it in a test environment.

  7. Draw your switch on paper and map which ports will go to which vLANs.
    It's helpful to physically group connections so that they're in the same logical vLAN, but this isn't strictly necessary.

  8. Turn your switch drawing into a switch configuration. Ideally play with it in a test environment.

  9. Clean up your drawings on paper. The logical drawing should look somewhat like this:
    Network Diagram
    (The image has been shrunk to obscure stuff you don't need to read)

  10. Get someone else to look at your design.
    You can ask on Server Fault, but it's better if someone familiar with your environment looks at it as they're more likely to catch potential breakage.

  11. Take a weekend and turn your logical design into a physical reality.
    (It should go without saying that you should have a rollback plan in case things go horribly wrong, but I'm saying it anyway.)

(If you are VERY good you might be able to skip some of the "Draw it on paper" steps above, but I don't recommend skipping that your first time.)

Re: the two specific questions you asked:

1)How can I segment this network with minimum down time on the devices already on the network?

You can't. Breaking your network into vLANs will require an outage window - you will have to reconfigure your switch, move machines into different logical networks, configure routing, probably move some cables around, etc. etc. etc.
Plan for an outage starting at 5PM Friday and extending over a weekend, ESPECIALLY if this is your first time designing a properly segmented network - you will spend some time debugging things that break.

2)Can I just create Vlans and leave all these Vlans in the same laye 3 network so that they can go out of the network (I am not not concerned about Vlan routing) or I have to create subnets which means reconfiguring the existing devices (something I do not want)

Can you? Yes.
Will it buy you anything in terms of security? Not really.
Will it make the entire project 10 times harder? Absolutely.
Should you design a network this way? NO.

share|improve this answer
Very nice chief. One thing he should take advantage of is if he's buying new switches to accomplish this is to take the time to "lab it out" with some old laptops, a pfSense box, etc. to put theory to practice, learn the switch syntax/UI, etc. – gravyface Sep 20 '12 at 17:49
Absolutely - if you're going from a flat topology with unmanaged switches to vLAN segmentation on managed switches the transition is a great time to spend an extra week or two getting familiar with the ins and outs of your new hardware. You can also lab out your vLAN design using VMWare -- ESXi supports tagged vLANs in the virtual switch, and that's a great way to learn without having to buy lots of hardware or deal with cables. (As a bonus you can plug that virtual switch directly into a trunk port on your physical switch and the vLAN tags Just Work - at least in simple configurations.) – voretaq7 Sep 20 '12 at 18:28
That's well explained. Thanks – Paddington Sep 20 '12 at 19:57

How can I segment this network with minimum down time on the devices already on the network?

Leave the current network as the default VLan. For each device that is being moved to a new VLan, reconfigure its port and change its address information to the corresponding subnet one device at a time.

Can I just create Vlans and leave all these Vlans in the same layer 3 network

No. This is entirely against the very concept of a VLan.

(I am not not concerned about Vlan routing)

You must providing routing between VLans for devices on different VLans to communicate.

or [do] I have to create subnets which means reconfiguring the existing devices (something I do not want)

Then you may not desire to have VLans.

share|improve this answer
There are some terribly nasty things you can to to have one subnet spanning multiple vLANs. I saw it once. Ever see a school of Piranha eat a life elephant? (No? Me either, but I imagine it looks an awful lot like that environment :-) – voretaq7 Sep 20 '12 at 18:24
@voretaq7 Today I learned that proxy arp might look like a school of piranha eating an elephant. Nice. – Jeff Ferland Sep 20 '12 at 18:30
SHH! Don't speak its name! It's like Bloody Mary - if you say it three times while looking at your switches the cables come to life and strangle you! – voretaq7 Sep 20 '12 at 18:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.