A small school has currently 30 PCs connected through wifi access points to the internet (3 WANs), but there's no real LAN at the moment, apart from about 8 cables running from the APs to the modems. Finally the plan is to: - buy a switch 24p - buy a Windows Server 2012 - buy a network failover/balacing bandwidth aggregator


-----------          ----------           ------------           ----------------- 
| 5 VLANs | <------> | Switch |  <------> | Failover |  <------> |  3 modems     |
-----------          ----------           ------------           ----------------- 


  • Each VLAN may access the Windows Server 2012 (file server, shared folders)


  1. Is a managed L2 switch sufficient for this task?
  2. Does the server needs multiple NICs?

Answers to original questions:

  1. A managed L2 switch with 802.1q VLAN support is sufficient if all routing between subnets is done on another system (your router or your server or another machine with a 802.1q compatible NIC and software). If you want to route on the switch, you have to buy a L3 enabled switch. It depends mostly on your performance needs (single system would be bottleneck, as all traffic from all ports has to go through it).
  2. As long as the NIC supports 802.1q VLAN tags, you can do it with a single NIC. Depending on operating system it might be easier to configure different NICs, and the cost of the hardware is relatively low. It also depends on your traffic patterns whether 4 single NICs or 4 aggregated NICs are more efficient.

Do VLANs help with security?

  • They can help by segregating traffic into different subnets, but it should be combined with other things. For example, when using 802.1q and 802.1x (RADIUS), a new device can authenticate itself (by password or certificate) upon first contact (via wireless or cable) and will then be assigned to a VLAN depending on your set-up rules (guest VLAN, teacher VLAN etc.). Similarly, if you combine them with IPSec or any other VPN solution, you have encrypted traffic and even in the same subnet nobody can read/understand traffic not intended for him. You can and should combine different technologies.
  • There exist attack scenarios where the goal is to break out of a VLAN (by bug/exploit or by exploiting badly configured VLAN setups). As long as you configure your VLANs correctly, you will most likely be fine. Very sensitive information could still be managed separately (air gap or with separate hardware) if you like.
  • There is overhead in management and configuration, so you should decide if it is worth your time to configure it correctly. You get the most out of it if your desired network topology
    • changes frequently, but hardware remains fixed, or
    • is complicated and different to your physical layout, or
    • is impossible to model physically.
  • Thanks you very much for helping :-) - I thought network performance & security would benefit from using VLANs but if enabling this require high performance devices I will turn to 1 LAN! For instance I though about a switch such as the HP 2530 24G. Also I am worried when you say that all traffic would be directed to on "system" you mean the switch or the server? 2 - Windows Server 2012 has built in tagging, maybe it would be wise to buy a high performance NIC? – Riccardo Sep 21 '16 at 10:08
  • @Riccardo Thank you. I've added to my answer regarding your follow-up questions. You should edit your main question with these and also make your goals clearer (what you want to achieve, where you see problems, etc.). Your question covers large different areas (failover, load balancing, NIC teaming, multiple modems, active directory, network security, network topology, hardware recommendations) and it would be good if you could expand on your situation so we may help better. – user121391 Sep 21 '16 at 11:22
  • 1
    @user121391 Put up a very good answer. I would agree with the majority of what he says, I would add though it it is much more preferable to use your switch or, potentially (but not ideally) a firewall to route between your various VLAN/subnets and not to configure your server 2012 install as the router. If your server falls over for any reason your whole network will go down. – Alex Berry Sep 21 '16 at 11:29
  • Thank you Alex, actually the Windows server should only act as the file server, while Internet connectivity should be accomplished by the aggregator, so if the server should fail, only file server would fail... – Riccardo Sep 21 '16 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.