Routing for WAN Question

[larry22]

Okay, we have a Fiber WAN now through our ISP connecting 4 schools in hub and spoke.  Everything is working fine now with the config you will see below.  However, this summer I want to have our 5412zl do all the routing for all the schools.  The way it is set up now is that I have a 5412zl (config below) but I have a switch at each school doing routing for their school (2910al's).  I'm using roughly 2-5% CPU usage on the 5412zl and I figured it would be more efficient to "dumb down" the switches at the other schools and have the 5412zl handle all the routing for all the VLANs at all the schools.  As you will see, I have already set up the VLANs for all the schools and added the ip helper-address for DHCP.  Before I go any farther I want to know:

1) Since none of the VLAN ports from the other schools (ABS, HES, WS) are tagged on this switch, can I add the IPs or will that screw anything up?

2) Then, when I'm ready, I can A) tag all the VLANs on the port that the ISP fiber is plugged into, B) turn off routing on all the other switches at the other schools, C) turn off the default route at each of the "core" 2910's at the other school, D) shut down VLAN9 Inter-School VLAN, and E) REMOVE all those static routes I added on the config below, correct?

Here is the config:

HP-E5412zl# show config

Startup configuration: 128

; J8698A Configuration Editor; Created on release #K.15.07.0008

; Ver #02:1b.2f:36

hostname "HP-E5412zl"

time timezone -300

time daylight-time-rule Continental-US-and-Canada

module 1 type J9538A

module 2 type J9538A

module 3 type J9536A

module 4 type J9154A

module 5 type J9534A

module 6 type J9534A

module 7 type J9534A

module 8 type J9534A

module 9 type J9534A

ip default-gateway 10.1.2.50

ip routing

vlan 1

  name "DEFAULT_VLAN"

  no untagged A1-A8,B1-B8,C1-C22,D1-D2,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24

  no ip address

  exit

vlan 3

  name "Mirror"

  untagged E1,E3

  no ip address

  exit

vlan 9

  name "Inter-School"

  untagged I24

  ip address 10.9.1.1 255.255.255.0

  exit

vlan 110

  name "Chromebooks"

  ip helper-address 10.1.2.2

  ip address 10.11.0.1 255.255.254.0

  tagged A1-A4,A6-A8,C1-C4,G5,G13,I2,I22

  exit

vlan 15

  name "School A Public WLAN"

  ip helper-address 10.1.2.2

  ip address 10.15.0.1 255.255.252.0

  tagged A1-A4,A6-A8,C1-C4,G5,G13,I2,I22

  exit

vlan 10

  name "School A LAN"

  untagged A5,B1-B8,C5-C22,E2,E4-E24,F1-F24,G1-G4,G6-G24,H1-H24,I1,I3-I21,I23

  ip helper-address 10.1.2.2

  ip address 10.1.2.51 255.255.254.0

  tagged A1-A4,A6-A8,C1-C4,D1-D2

  exit

vlan 20

  name "School A Staff WLAN"

  untagged C1-C4,G5,I22

  ip helper-address 10.1.2.2

  ip address 10.2.0.1 255.255.254.0

  tagged A1-A4,A6-A8,G13,I2

  exit

vlan 11

  name "School A Student WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 50

  name "School C LAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 30

  name "School B LAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 40

  name "School B Staff WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 60

  name "School C Staff WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 70

  name "School D LAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 80

  name "School D Staff WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 12

  name "School B Student WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 13

  name "School C Student WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 14

  name "School D Student WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 16

  name "School B Public WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 17

  name "School C Public WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 18

  name "School D Public WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 19

  name "Central Office Public WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 90

  name "Central Office LAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 100

  name "Central Office Staff WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

vlan 102

  name "Central Office Student WLAN"

  ip helper-address 10.1.2.2

  no ip address

  exit

mirror 1 port E3

timesync sntp

sntp unicast

sntp server priority 1 96.47.67.105

ip route 0.0.0.0 0.0.0.0 10.1.2.50

ip route 10.3.0.0 255.255.254.0 10.9.1.3

ip route 10.4.0.0 255.255.254.0 10.9.1.3

ip route 10.5.0.0 255.255.254.0 10.9.1.2

ip route 10.6.0.0 255.255.254.0 10.9.1.2

ip route 10.7.0.0 255.255.254.0 10.9.1.4

ip route 10.8.0.0 255.255.254.0 10.9.1.4

ip route 10.9.0.0 255.255.255.0 10.9.1.5

ip route 10.10.0.0 255.255.255.0 10.9.1.5

ip route 10.10.2.0 255.255.255.0 10.9.1.5

ip route 10.12.0.0 255.255.254.0 10.9.1.3

ip route 10.13.0.0 255.255.254.0 10.9.1.2

ip route 10.14.0.0 255.255.254.0 10.9.1.4

ip route 10.16.0.0 255.255.254.0 10.9.1.3

ip route 10.17.0.0 255.255.254.0 10.9.1.2

ip route 10.18.0.0 255.255.254.0 10.9.1.4

ip route 10.19.0.0 255.255.255.0 10.9.1.5

interface A5

  monitor all both mirror 1

  exit

interface E1

  monitor all both mirror 1

  exit

primary-vlan 10

no autorun

no dhcp config-file-update

no dhcp image-file-update

password manager

password operator

[Ian Vaughan]

Howdy,
I would suggest that moving all of the routing to a single switch will only make the blast radius of any problem bigger.
I would look to do the opposite and potentailly run a dynamic protocol (the 2910's will do RIP v2) over your inter-school network for route distribution and dynamic failover. Do you only have one upstream network exit point at one of the schools?
Are all services hosted in just the "main" site?
Is there voice traffic on this network?
Do local services have to be maintained if the WAN link goes down?
Is the hub & spoke actually more of a point to multipont "mesh" topology
Networks can be "advertised" into the routing proto and save on having to put static routes on every site if you make a change.
You can standardise your VLAN numbering across the sites and in the future have consistent RADIUS profile driven dynamic VLAN assignment for end users.
In conclusion - yes you can pull all of the L3 back to one switch but any problem could become 4x bigger that it would be today.
HTH
Ian