We have a medium sized network of around 200 nodes and are currently in the process of replacing old daisy chained switches with stack-able or chassis style switches. Right now our network is broken up via subnet; production, management, IP, etc each on a separate subnet. Does anyone have an opinion on whether creating Vlan's instead of subnets would be more beneficial? Our general goal is to prevent bottlenecks, separate traffic for security, and to manage traffic with more ease.
One suggestion would be to actually implement both
Have, for instance, VLAN 10 - 15 for your different device types (Dev, Test, Production, Users, etc)
VLAN 10, you may have the subnet 192.168.54.x/24 VLAN 11, you may have the subnet 192.168.55.x/24
And so on
This would require that you have a router within your network, though
It's kind of up to you what route you go down (You know your network better than I ever will). If you think that the size of your broadcast domain will be some kind of issue, then use VLANs. If you think that the size of your network management domains (for instance, your management network) then possibly use a network closer to a /16 over a /24
Your 200 nodes will fit into a /24, but that obviously doesn't give you much scope for growth
By the sound of it, you're already using different subnets for different device types. So, why not stick with that? You could, if you wanted, tie each subnet to a VLAN. Layer 2 segmentation will result in the behaviour of your network changing from how it behaves currently though
You would have to investigate the potential impact of that
(I've been on the road all day and missed jumping on this one... Still, late to the game I'll see what I can do.)
Typically you create VLANs in Ethernet and map IP subnets 1-to-1 onto them. There are ways not to do this, but sticking in a strictly "plain vanilla" world you'd create a VLAN, think up an IP subnet to use in the VLAN, assign some router an IP address in that VLAN, attach that router to the VLAN (either with a physical interface or a virtual subinterface on the router), connect some hosts to the VLAN and assign them IP addresses in the subnet you defined, and route their traffic in and out of the VLAN.
You shouldn't start subnetting an Ethernet LAN unless you have good reasons to do it. The best two reasons are:
Bandwidth exhaustion problems (unless they're being caused by broadcast packets or flooding of frames) are not solved with VLANs and subnetting typically. They happen because of a lack of physical connectivity (too few NICs on a server, too few ports in an aggregation group, the need to move up to a faster port speed) and can't be solved by subnetting or deploying VLANs since that won't increase the amount of bandwidth available.
If you don't have even something simple like MRTG running graphing per-port traffic statistics on your switches that's really your first order of business before you start potentially introducing bottlenecks with well-intentioned but uninformed subnetting. Raw byte counts are a good start, but you should follow it up with targeted sniffing to get more details about the traffic profiles.
Once you know how traffic moves around on your LAN you can begin to think about subnetting for performance reasons.
As far as "security" goes you're going to need to know a lot about your application software and how it talks before you can proceed.
I did a design for a resonably sized LAN/WAN for a medcial Customer a few years ago and I was asked to put access lists on the layer 3 entity (a Cisco Catalyst 6509 supervisor module) to control traffic moving between the subnets by an "engineer" who had little understanding of what kind of legwork it would actually require but was very interested in "security". When I came back with a proposal to study each application to determine the necessary TCP/UDP ports and destination hosts I got a shocked response from the "engineer" stating that it shouldn't be that difficult. The last that I heard they're running the layer 3 entity with no access lists because they couldn't get all their software working reliably.
The moral: If you're really going to try and button down packet and stream-level access between VLANs be prepared to do a lot of legwork with application software and learning / reverse-engineering how it talks over the wire. Limiting access by hosts to servers can often be accomplished with filtering functionality on the servers. Limiting access on the wire can provide a false sense of security and lull administrators into a complacency where they think "Well, I don't need to configure the app. securely because the hosts that can talk to the app. are limited by 'the network'." I'd encourage you to audit the security of your server configuration before I'd start limiting host-to-host communication on the wire.
99% of the time, a subnet should be equivalent to a VLAN (i.e. each access subnet should map to one and only one VLAN).
If you have hosts from more than one IP subnet in the same VLAN, you defeat the purpose of VLANs, as the two (or more) subnets will be on the same broadcast domain.
Alternatively, if you put one IP subnet into multiple VLANs, hosts on the IP subnet will not be able to communicate with hosts in the other VLAN unless your router has proxy ARP enabled.
|show 2 more comments|
I mostly agree with David Pashley: