elanvolant
IS-IT--Management
Here is the setup.
2 E2510-48Gs for gigabit desktop traffic
1 2824 for gigabit server traffic
2 E2520-24-POE for VOIP traffic
2 2650s for server/NAS management and WiFi traffic
1 2910al-24G-POE for Layer3/4 routing for above traffic and VOIP traffic
2 SonicWall Firewalls, one with DSL connectivity, one with Ethernet over Copper for Citrix access and VPN
I am setting them up this week at a new location. Previously we had 3 switches and no VLANs.
I am designating the following:
10.1.0.x for desktops and current server traffic (Default VLAN 1)
10.1.1.x for future VMware/NAS traffic (VLAN 10)
10.1.2.0 for wireless clients with Internet-only traffic (VLAN 20)
10.1.3.0 for VOIP phones and voicemail server (VLAN 30)
I've never set up VLANs before and therefore never needed to route between subnets so my understanding of the steps and questions are as follows:
1) Assign the VOIP and WiFi ports to their respective VLANs on the respective switches
2) Create physical connections between switches (that cross VLANs) on 2910al, assign appropriate VLAN and related IP to the right ports and turn on IP Routing. This will automatically route between VLANs assigned on the switch correct?
3) I want to prevent all traffic between 10.1.2.x and 10.1.0.x except for three specific PCs (which I can assign static IPs or use MAC addresses to identify). How do I do that? I want no traffic from 10.1.2.x to go to the other subnets either. I will have one port in VLAN 20 going to the SonicWall which will provide DHCP and metered Internet access.
4) Should I assign management IPs to the switches all in the 10.1.0.x range? For example, it's not good practice to assign the POE switches management IPs in 10.1.3.x. If I keep the management IPs in 10.1.0.x, then I need uplinks connecting all the switches with at least one port assigned to the Default VLAN?
5) Do I need turn on tagging on any ports? I don't really understand the need for tagging in my configuration. For instance, the DHCP requests will have a DHCP server in the VLAN requesting IPs. So one DHCP server for VOIP, another for WiFi traffic and and another in the Default VLANs. I assume these will not be routed by the 2910al by default.
6) In the web interface on the HP switches it offers four modes for tagging - No, tagged, untagged, and forbid. I assume I am using untagged in all contexts except for the ports that uplink to the 2910al and the ones that come in from the 2910al. For those I use tagged, correct?
I attached a PDF of my first attempt at a network diagram. Thanks in advance for any input you can offer.
2 E2510-48Gs for gigabit desktop traffic
1 2824 for gigabit server traffic
2 E2520-24-POE for VOIP traffic
2 2650s for server/NAS management and WiFi traffic
1 2910al-24G-POE for Layer3/4 routing for above traffic and VOIP traffic
2 SonicWall Firewalls, one with DSL connectivity, one with Ethernet over Copper for Citrix access and VPN
I am setting them up this week at a new location. Previously we had 3 switches and no VLANs.
I am designating the following:
10.1.0.x for desktops and current server traffic (Default VLAN 1)
10.1.1.x for future VMware/NAS traffic (VLAN 10)
10.1.2.0 for wireless clients with Internet-only traffic (VLAN 20)
10.1.3.0 for VOIP phones and voicemail server (VLAN 30)
I've never set up VLANs before and therefore never needed to route between subnets so my understanding of the steps and questions are as follows:
1) Assign the VOIP and WiFi ports to their respective VLANs on the respective switches
2) Create physical connections between switches (that cross VLANs) on 2910al, assign appropriate VLAN and related IP to the right ports and turn on IP Routing. This will automatically route between VLANs assigned on the switch correct?
3) I want to prevent all traffic between 10.1.2.x and 10.1.0.x except for three specific PCs (which I can assign static IPs or use MAC addresses to identify). How do I do that? I want no traffic from 10.1.2.x to go to the other subnets either. I will have one port in VLAN 20 going to the SonicWall which will provide DHCP and metered Internet access.
4) Should I assign management IPs to the switches all in the 10.1.0.x range? For example, it's not good practice to assign the POE switches management IPs in 10.1.3.x. If I keep the management IPs in 10.1.0.x, then I need uplinks connecting all the switches with at least one port assigned to the Default VLAN?
5) Do I need turn on tagging on any ports? I don't really understand the need for tagging in my configuration. For instance, the DHCP requests will have a DHCP server in the VLAN requesting IPs. So one DHCP server for VOIP, another for WiFi traffic and and another in the Default VLANs. I assume these will not be routed by the 2910al by default.
6) In the web interface on the HP switches it offers four modes for tagging - No, tagged, untagged, and forbid. I assume I am using untagged in all contexts except for the ports that uplink to the 2910al and the ones that come in from the 2910al. For those I use tagged, correct?
I attached a PDF of my first attempt at a network diagram. Thanks in advance for any input you can offer.