Subnetting a network ...

[mrdom]

Hi everyone:

I'm an assistant network administrator for our parish church and school. We're looking to fine-tune our network in the coming weeks, and I'm hoping to seek some guidance from forum members as my knowledge on subnetting is rusty at best.

Here's the current setup:

1. All devices on the network (parish and school) can see each other, and have addresses in the 172.20.x.x range, with a subnet mask of 255.255.0.0

2. The school is interested in obtaining its own file server (curently, there isn't one). We will most likely obtain Windows 2000 server, because we can get a good deal on the software with the number of client licenses we need.

3. The parish already has its own server - a server running Windows 2003 with AD. I have great fear and trepidation about adding a 2k server into the picture, as this may create huge problems. But maybe not?

4. I thought about the possibility of subnetting the school's network away from the parish's. We would be on one subnet, and the parish would be on another subnet. The parish does not access anything school-related, and the school does not access anything parish-related, so that would not be a problem. Could this work, and if so, what subnet mask could I use to accomplish this?

5. We have a T1 Internet connection, and the router address is 172.20.0.1/255.255.0.0 Would it be possible to still route internet requests from school computers if we were to change to a different subnet?

6. I would like to do DHCP assigning of addresses, but the only way I can think to accomplish this would be to gather up the MAC addresses of every machine in the school, and then match the MAC address with a particular IP address, subnet mask, etc. in a DHCP table. Would this be the way to go, or would there be a better solution?

Thanks much for your help - really appreciate it. Let me know if you need more info. about our network setup, and I'll do my best to be as specific as possible.

 

[burtsbees]

4.Yes---use a 255.255.255.0 mask..e.g.
172.20.1.0/24
172.20.2.0/24
would be separate from eachother. This would allow
5.They would all get out still, but be separated behind the LAN.
6.use dhcp in the router, or either of the servers.

Burt

 

[mrdom]

Could I leave one subnet as 255.255.0.0, and change the subnet on the computers we want to break into our own group to 255.255.255.0? If I do it this way, would I need to add an entry to the router giving access to this subnet?

My goal is to only change subnets on the machines that we need to break into our own group, and not campus-wide, if that would be possible.

 

[burtsbees]

If you don't want the subnets communicating with eachother, then you'd need acls in the router.

Burt

 

[CiscoWizard]

Using subnet juggling on the host is NOT recommended (you will have a hard time convincing a group of nodes to use the correct broadcast and network address), best is to allocate an entirely new subnet for the new task; if your hardware supports it do so in it's own VLAN. Optionally move the internet link (router) to yet a 3rd subnet. Use a router or MLS capable switch to connect the segments and use ACL (Access control List) to filter what traffic may pass from what subnet to what subnet.. anything short of this will most likely create an exotic networkers nightmare ;-)

rgdz
CW

 

[gb0mb]

The 255.255.255.0 mask allows for 254 addressable IPS. will that be enough address space to cover all the nodes of each network and any possible future growth? Better to plan for the future than right now.

If you going with windows 2k server to save money, have you thought about a possible free alternative with linux?

If you wish the granular control an Active Directory infrastructure gives you then the Windows 2k Server will work great.

When I was in college the admin used a program, correct me if I am wrong, Black Ice. This program let you change whatever, install whatever, but when the system rebooted it went right back to its original configuration. Not a bad thing to have when dealing with students.

Gb0mb

........99.9% User Error........
Ubuntu -- African for I can't install Gentoo

 

[burtsbees]

What is African for "I can't get Red Hat Server Enterprise 2.1 to install using a TFT5600 display without x conf screwing up the geometry!!!"
I'll start from scratch...AGAIN!
lol

Burt

 

[mrdom]

Thanks for the post, gb0. I was aware of the limit of addressable IP's that the class A subnet would have. This would more than meet our needs, with plenty of room for expansion in the future, if necessary.

I've been doing some additional research, and it seems that Windows 2003 Server is just as affordable as Win2k Server is ... might as well splurge and get a version that it still in active support.

A Linux box would be wonderful, and in fact, that's what were using right now as a temporary solution. It's working out well, but the other coordinators just don't feel comfortable enough with the Linux environment. I must admit that I myself would be a novice user of the Linux environment. I guess I learned enough to set the server up and get it working though, so there's something to be said. We're all windows oriented, which is why the Windows-based server product would most likely be the best option.

Can someone answer a question for me about device and user-based CAL's? I haven't had to deal with licensing stuff since the NT4.0 days, and things have changed considerably since then.

My understanding is that a a device-based CAL allows devices to connect to the server, whereas a user CAL allows a user to connect from multiple locations. Is that correct?

If I were to order licenses to cover our 5 or 6 PC users, and our newly acquired PC lab, would I be interested in purchasing device-based CAL's or user CAL's? Our users have about three or four shares mapped to the server in a given session, and the same goes for the PC lab. Device CAL's are much cheaper than user CAL's, and while the savings would be nice, I want to do this right.

Can a device CAL access the server with multiple connections/multiple shares, or is a device limited to just one connection, and that's it?

Thanks a lot for the continued help.