1

I am trying to get my head around the practical implementation of VLANs/Subnets.

I currently have 3 HP v1910 switches with the following subnets/VLANS;

  • 192.168.20.0/24 Production Server (7 servers virtual & physical)
  • 192.168.30.0/24 Production Clients (25 PCs)
  • 192.168.35.0/24 Production Printers
  • 192.168.50.0/24 WSUS Server
  • 192.168.70.0/24 Admin PCs (6 or 7 PCs)
  • 192.168.80.0/24 Hyper-V Hosts (2 servers)
  • 192.168.90.0/24 IP Phones

There is a vlan interface defined for each subnet (all 192.168.x.1 addresses) on Switch1. Switch 1 is connected to a Watchguard firewall, and from there to an ISPs basic internet router.

The main reason I split up these (rightly or wrongly) was to make it easy to restrict access. i.e

  • All production stuff talks to each other.
  • WSUS talks to everything except IP Phones
  • IP Phones only talk to Prod PCs or Admin PCs (IP phone has dedicated gateway out for voip)
  • Admin PCs (non-domain based) can’t communicate with anything production
  • Admin PCs have internet access
  • Production PCs have very limited internet (only production services, not browsing etc)
  • Data servers have no internet access
  • WSUS has internet access
  • Hypver-v only talks to the servers subnet (where DCs are) and WSUS

This is working fine until I wanted to create some more VLANS. The v1910 can only have a max of 8 VLAN interfaces created.

Do I just create the next x number of VLANS on Switch 2, have I over-complicated things? Or am I expecting too much and need some better hardware?

Thanks

  • That model switch supports 256 VLAN's but only 8 VLAN interfaces ( as you stated) which are needed for routing between VLAN's. It's not clear to me which VLAN's you need to route. Can you expand that part of your question? For instance you say that only Admin computers have internet access and then you say that IP phones can't communicate with servers, which means that the IP phones can't communicate with servers AND they can't connect to the internet... so what exactly can they connect to and communicate with? Have you mapped out which subnets need to communicate with which other subnets? – joeqwerty Apr 12 '18 at 16:43
  • @joeqwerty Great point. No but ill do that. – gjpio Apr 13 '18 at 15:50
3

The 8 VLAN interface restriction on the v1910 is for routing purposes. If you have something else do your routing, then you can create as many VLANs as you need.

I would probably look at putting a bigger switch at the top of your topology - one that can do all the L3 routing needs for all your VLANs, and connect your switches to that one in a hub-and-spoke topology.

You then connect your Watchdog to your top switch, and trunk all your required VLANs into that for internet access, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.