I'm sure this is a very basic/common networking problem. I have 1 web server and 2 database servers that are co-located in a data-center. I have been issued 10 public IP addresses and I have a 10 port 1-GBit Cisco Switch (supports L2 and L3 modes).

Currently these 3 servers are connected to the switch and configured with public IPs, there's no VLAN and I'm not using any advanced features on the switch. The web server uses 2 additional NICs to cross-over to the 2 database servers, which are each independently connected to the switch and accessible on a public IP.

Now I need to add possibly 2 more web servers so I need to setup a private internal network (192.168.1.xxx) on the switch so all the servers can talk to each other, but I also need to be able to access each respective server over a public IP, e.g. for Remote Desktop Administration, I also occasionally need access over 1433 to interface with a SQL Server.

My question is, can this be done just using a switch, or do I need a router? Each server has a minimum of 2 NICs, does each server need 2 connections to the switch, one for the internal IP range and one for outside access?

Sorry if I've missed any pertinent details.


What you are asking for is possible to achieve with VLANs. It will even be possible to do on some unmanaged switches, though a managed switch will give you some more options.

You can leave your public IPs on the untagged VLAN, which means the public IP segment will be business as usual and require no configuration changes to the router on the other side of the switch.

Then on each host you create a virtual interface for a VLAN tag and use those for your internal segment. For example if you use Linux, the command to use could be vconfig add eth0 10 which would create an interface named eth0.10 and send and receive packets with VLAN tag number 10. You can then bring up those virtual interfaces on each host, just as if they were a physical interface.

If it is an unmanaged switch capable of switching tagged packets, then there is nothing more to it.

If it is a managed switch, it might not permit the tagged packets by default. In that case you would have to enable the VLAN tag on each port in the switch configuration. A managed switch does you some other options though.

If you have spare ports on the switch, you could choose that those are to be used for the ports, which are currently connected through crossover cable. Before you connect those, you need to configure VLANs on the switch.

You could configure all the currently used ports to use VLAN 1 as untagged and VLAN 2 as tagged. And you could configure the ports to be plugged in next to use VLAN 2 as untagged and VLAN 1 as tagged.

Then you can connect each of those ports to the switch instead of through a crossover cable. That way you can get started with the VLANs without needing to reconfigure the servers right away.

The next server you add could have only a single network connection, which could be given access to both VLANs. At that point you'd have to decide which VLAN would be untagged, if any of them.

| improve this answer | |
  • Thanks! We actually have two Cisco SG300-10 switches so my plan is to keep the current switch and network topology for the public IPs and then use the second NICs on each server to connect to the second Cisco Switch which will be configured on a VLAN for internal networking. Hoping this will work :) – user220150 May 19 '14 at 9:21
  • @user220150 That would work as well. In that case you won't even need any VLAN features on the switches. At least your question mentions only two IP segments, and with two switches you'll just be using one IP segment on each switch. – kasperd May 19 '14 at 9:31
  • That sounds about right. So straight out of the box the switch will have it's own LAN (192.168.1.xxx)? So given my network is flat (i.e. 4 machines that can communicate together on a single network) no VLAN is needed? The simpler the better, that works for me! If one of those switches blows up I'd feel much more comfortable if I could just swap it out without having to remember some complex configuration. Thanks for your help! – user220150 May 19 '14 at 9:38
  • @user220150 A switch does not know about IP addresses. The switch operates at a lower level of the stack. You can run whatever IP address you want across a switch with no configuration needed on the switch itself. The only cases where a switch would know about IP addresses is if it has a configuration interface, which is accessed over IP, or if the switch is not just a switch but also a router. – kasperd May 19 '14 at 9:54

You'll want a firewall. Something like a Cisco ASA 5505 firewall will provide you the ability to NAT public to private IP addresses and allow you to use the full block of IP addresses you've been allocated.

When you re-IP your hosts, you can still maintain VLANs on your switch and run internet-bound traffic through the Cisco ASA.

| improve this answer | |
  • Thanks, our datacenter already provide a firewall. Does that mean I could possibly ask them to route the public IPs to my own private IPs, or would they have no way to see my private network? Of the 10 IPs I've been given I know that the first one in the range is configured as my default gateway. – user220150 May 18 '14 at 21:28
  • NAT would introduce another possible point of failure. I currently manage a server which is behind that sort of NAT, and it is causing problems. I don't know which brand of firewall it is, but the problems are inherent to any stateful NAT. – kasperd May 18 '14 at 21:37
  • I guess the point of adding the additional servers is for load balancing and high availability. So that's a good point, if delivering this means adding more points of failure further down-steam that's going to be a problem. I'm afraid that if my own firewall blows up, it doesn't matter how many servers I have, I'll have a lot of downtime. So then I need a cold firewall on standby, which is obviously expensive. I'm trying to get the sweet spot of cost vs resilience. – user220150 May 18 '14 at 21:44
  • @user220150 This is a question for your co-location facility. I'm not sure what their offering is, but it's best to explain your intentions and desired results to the datacenter support staff and see what's possible with your setup. – ewwhite May 18 '14 at 21:45
  • Sure, will be giving them a call tomorrow morning. – user220150 May 18 '14 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.