Switches, Hubs, and Modems
1748073 Members
5651 Online
108758 Solutions
New Discussion юеВ

Re: Another VLAN noob

 
SOLVED
Go to solution
sephiroth_4
Occasional Advisor

Another VLAN noob

I have a 5308xl with several layer 2 managed switches connected via fiber for different locations. Bear with me...

Can I just say all ethernet ports are one VLAN, and the fiber connections are different VLANs on the 5308? Our network is a big and flat network with 172.16.x.x/16. Should I do some changes or is it possible to reduce SOME traffic by simply configuring VLANs on the web interface of the 5308?

Am I thinking too simply? Any help will be great!
7 REPLIES 7
OLARU Dan
Trusted Contributor

Re: Another VLAN noob

VLANs will help with many things, among which:

1. Separate the departments' computers (e.g. Finance is on a separate IP subnet than Engineering) so you can control access: Engineers only will have acces to Engineering servers, Finance people only to Finance servers, and each and everyone may authenticate to domain controllers in a third VLAN/subnet.

2. You are able to reduce Ethernet/IP broadcasts, if the performance of the network is downgraded by broadcasts due to large number of computers.

How many computers do you have in your network?
sephiroth_4
Occasional Advisor

Re: Another VLAN noob

less than 600
Joel Belizario
Trusted Contributor
Solution

Re: Another VLAN noob

I tend to approach VLAN implementation from a security standpoint rather than a performance one.

Before you implement VLANs, I'd highly recommend discussing network security in general with the business stakeholders in your organisation, and then designing a solution from there.

An analogy that comes to mind regarding your current network setup is that everyone is basically sitting in the same room without walls to segregate anything. Businesses don't operate this way and I don't think a network should either.

There are a million and one reasons to implement VLANs but it comes down to what is required for your organisation.

Just my 2 cents. :)

BTW, have a read of this great whitepaper on VLANs by Cisco, it talks about features specific to their products but has lots of good food for thought:

http://www.cisco.com/warp/public/cc/pd/si/casi/ca6000/prodlit/vlnwp_wp.pdf
sephiroth_4
Occasional Advisor

Re: Another VLAN noob

Well, since you put it like that, there's really no need to implement VLANs in our network. I just thought it would help performance by keeping the different campus' broadcasts @ that location. Thanks!
Joel Belizario
Trusted Contributor

Re: Another VLAN noob

Well don't get me wrong I'm not saying that you don't need VLANs, 600 hosts is a sizeable network. But maybe I should have clarified my train of thought further...

The main point I was trying to make is there are many approaches to designing a network, and sometimes things are done for the sake of doing them without really considering what is needed.

In your case you are looking at performance issues but it is quite possible depending on what actually happens on your network you may not see the peformance increase you are looking for.

But there are still many valid reasons to consider segregating your network, some of which have been mentioned above.

One of the major risks to a flat network is if there is a broadcast loop (like some user decides to help keep cables tidy by plugging a loose cable into two ports on the wall), you will probably lose your whole network.

Viruses also come to mind, if they ever get past your scanning software they will have unimpeded access to every host in the network.

So yea, my intention was to give you more food for thought rather than flat out say yay or nay to VLANs.

Hope this helps. :)
sephiroth_4
Occasional Advisor

Re: Another VLAN noob

I understand, but I just implemented the loop-protect on the 5308, so that will help us out a bunch...we have a lot of "helpers". Great read also!
Joel Belizario
Trusted Contributor

Re: Another VLAN noob

A lot of "helpers"... LOL :)