I am trying to get my head around the practical implementation of VLANs/Subnets.
I currently have 3 HP v1910 switches with the following subnets/VLANS;
- 192.168.20.0/24 Production Server (7 servers virtual & physical)
- 192.168.30.0/24 Production Clients (25 PCs)
- 192.168.35.0/24 Production Printers
- 192.168.50.0/24 WSUS Server
- 192.168.70.0/24 Admin PCs (6 or 7 PCs)
- 192.168.80.0/24 Hyper-V Hosts (2 servers)
- 192.168.90.0/24 IP Phones
There is a vlan interface defined for each subnet (all 192.168.x.1 addresses) on Switch1. Switch 1 is connected to a Watchguard firewall, and from there to an ISPs basic internet router.
The main reason I split up these (rightly or wrongly) was to make it easy to restrict access. i.e
- All production stuff talks to each other.
- WSUS talks to everything except IP Phones
- IP Phones only talk to Prod PCs or Admin PCs (IP phone has dedicated gateway out for voip)
- Admin PCs (non-domain based) can’t communicate with anything production
- Admin PCs have internet access
- Production PCs have very limited internet (only production services, not browsing etc)
- Data servers have no internet access
- WSUS has internet access
- Hypver-v only talks to the servers subnet (where DCs are) and WSUS
This is working fine until I wanted to create some more VLANS. The v1910 can only have a max of 8 VLAN interfaces created.
Do I just create the next x number of VLANS on Switch 2, have I over-complicated things? Or am I expecting too much and need some better hardware?