0

We're designing a somewhat large system that we're not really qualified to design. It will be something like a campus: one main, large network, with about 20 sub-networks that are like departments with a few subnets for different labs or subsystems that need to be on their own VLANS.

The debate is, should we try to get each department it's own IP space, or use the same space for each department and hide behind NAT. Either way there will be decent, layer 3 switches for the gateway of each department.

The argument for using the same scope over and over is that it will be easier to configure these cookie-cutter subsystems the same for each department. There are a lot of non-pc, non-network-device devices in the systems that need to be manually configured with static IPs. The plan for administering these devices remotely is to open a couple ports in the NAT to vnc/remote-desktop to a PC inside. Then use the applications installed on that PC and web-guis to manage the devices. I think the NAT table will just grow and grow, but at least the config will be able to be easily duplicated to all the routers.

I feel like you lose a lot of advanced networking features by doing it that way. Off the top of my head: central dns and dhcp services, deploying OS images over the network to crashed machines, deploying configuration and media...

What else?

Feel free to edit my title and post to make more sense. Should I make a drawing?

10
  • 7
    "We're designing a somewhat large system that we're not really qualified to design." Oh dear. Hire someone that knows what they're doing. Seriously. This is not complex stuff, but with your general lack of experience, you're going to shoot yourselves in the foot dozens of times.
    – EEAA
    Mar 19, 2014 at 19:28
  • 5
    Also: do not duplicate subnets, and do not NAT (except at your internet egress point perhaps). You have millions of IP addresses in the RFC1918 space(s) available to you. There's no good reason to duplicate.
    – EEAA
    Mar 19, 2014 at 19:31
  • 3
    What kind of non-network-device needs an IP address... If there is no network, how is there IP?
    – Zoredache
    Mar 19, 2014 at 19:31
  • 2
    This question appears to be off-topic because solving this problem the right way requires that the OP hire a network engineer.
    – EEAA
    Mar 19, 2014 at 19:42
  • 5
    There's no debate here: Trying to give everyone the same private IP space and NAT between them is patently absurd. Nobody will be able to talk to each other, and that includes the administrators who have to manage this nightmare! Mar 19, 2014 at 19:49

1 Answer 1

3

The main curse of reused subnets is also its blessing: the subnets will not have any way to route between them, so they will never be able to talk to each other. This is bad if you want to interconnect them, but good if you want to force them to be isolated.

You can still support networks services outside the NAT layers - but not behind the NAT unless you forward ports.

I for one would not use such a system; I would instead use routers between the distinct broadcast domains to interconnect the various domains. On those routers I would be able to add any firewaling I might want.

Not the answer you're looking for? Browse other questions tagged .