Network setup for a multi-tennant office space

Question

I need to set up a new network for a client that will be leasing parts of their office space and providing shared access to internet and printers. Here are the details:

• Internet access will be shared between tenants.
• Tenants cannot see each other.
• Tenants can see a group of shared resources (printers, scanners).
• Tenants may require using their down DHCP server for VOIP phones or their own AD domain. (optional requirement)

I"m looking for recommendations on how to set up the switch(es) and router(s) in order to accomplish this. Specifically, i'm not sure how VLANs operate when sharing resources or an internet connection.

Any insight would be appreciated.

Answer 1

Put every tennant into its own vlan, and shared resources in a separate vlan, and set up routing between them.

Each vlan is like a 'switch-within-a-switch'. If ports 1-4 are in vlan10 and 5-8 are in vlan20, then it's the same as having 2 4-port switches in one box. Uplinks are "combined" as a trunk-port.

Connect the router to a trunk port, and set up vlans on the router (you get a "virtual interface" for each vlan, so again, same as with many different switches and interfaces connecting to them, but with just one cable and one real interface), and set up appropriate routing and firewall where needed (routing shouldn't be a problem and should work immediately, but all the tennants will be able to reach all the other tennants' networks without some firewall rules/ACLs).

Set up rules to dissallow connections from one tennant network to another, but allow connections from all internal networks to shared-resources network.

Sharing the internet connection is a bit tricky if you need public addresses, but if you're behind nat, just enable nat on all interfaces where it is needed.