Class C subnets within Class B network for VLAN

[PMCook]

I have a Class B network, 10.6.0.0/16. I have a ProCurve 4100. We have many printers networked, we want to isolate broadcast domains and put the printers on their own VLAN. I cannot change the B network to a C.

Can I create a subnet, say 10.6.10.0/24 within that network, assign the VLAN to that subnet, then assign the printers say 10.6.10.2/24 10.6.10.3/24 etc? If so what configuration commands are required?

What I really want to do is to create a 1 port VLAN as a Class C as above, then run another switch off that, then plug my printers into that switch. This would ease adding more printers down the road and it would not use up my available 4100 ports. Are there any issues with this configuration?

As much as possible, this site must not require the management of multiple VLANS as they have no real tech support on site. Hence my approach.

[Matt79 · Accepted solution]

Hi PM,

Other than the 10.6.0.0/16 subnet you haven't mentioned any others, so I assume this is the only subnet currently configured and therefore in the Default VLAN: VLAN 1.

If this is the case then presumably Routing is not enabled on the 4100 and the default gateway of all your devices on the network is your firewall, rather than 4100. If that's the case then your setup to add a second VLAN is going to be a little more involved. We'll get to that later, but for the moment let's just discuss the possibility of adding another VLAN...

You can technically create a new VLAN using a subnet of 10.6.10.0/24 as you describe, but since this is a subnet of your Class B subnet the routing would actually fail when you came to test it.

What you need to do is create a completely different subnet (that doesn't overlap with your Class B one) so the switch can route between the two.

For example, you could create VLAN 2 which could have IP 10.7.10.1/24. Your printers could then be on 10.7.10.10, 10.7.10.11 etc. The printers Default Gateways would be the 4100's address of 10.7.10.1

And you would need to enable Routing on the switch, to allow the two VLANs to route between each other.

The configuration required would be as follows:

(config)# vlan 2
(vlan-2)# ip address 10.7.10.1/24
(vlan-2)# untagged A1
(vlan-2)# exit
(config)# ip routing

This untags port A1 on your switch, so you could uplink a non-managed (standard) switch into A1 and hang all your printers off that. Or add more untagged ports into the config to do it all from the 4100, eg:

(config)# untagged A1-A8, A23, B4-B7

HOWEVER - as I mentioned at the very beginning, if this is the first time you're enabling Routing on the switch you're going to run into a routing problem.

Currently I presume you have a firewall acting as the Default Gateway on your network. And I'll hazard a guess that it's address is 10.6.0.254 /16, and that your 4100 in VLAN 1 is on 10.6.0.1 /16

In order for your printers and PCs to be able to see each other you're either going to have to change the Default Gateway of all devices to the 4100's address (in their respective VLAN), or add a Static Route on the LAN of your Firewall to bounce traffic destined for the Printer VLAN back to 10.6.0.1, so the 4100 can route to 10.7.10.0

If you choose the first option (changing everything's default gateway) you would then need to add a Default Route on the 4100 to tell it how to get to the Internet (via the Firewall). This command would be:

(config)# ip route 0.0.0.0 0.0.0.0 10.6.0.254

I hope that all makes sense.

Best regards,
Matt

[PMCook]

Hi Matt

Ys it all makes sense. I am a consultant woking for a client. They have established the class B.

The switch is totally uncnfigured. Not even an IP address. They just use it now as a smart hub with spanning tree. I understand now all 100 some nodes are all in VLAN-1 by default? Should I assign the 4108 an address of say 10.6.0.1 or 10.6.0.254? Or does that matter with the default VLAN?

They have 4 remotes sites, 10.2.0.0/16, 10.3, 10.4 and 10.5. The 10.6 is their main facility. Were it me, I would have gone all /24 subnets.

Their router is a Cisco 2581, IP 10.6.254.254.

OK, so I think I see what I need to do. I can create a 10.7.0.0/24 VLAN. All the nodes will have a /24 subnet mask. I will untag the port I use for VLAN-2 and hook up a simple switch. I will add a route to 10.6.254.254.

Do I have it all down correctly? Thank you for your help.

Paul

[Matt79]

Hi Paul,

Yes that's right - by default every port is an untagged member of VLAN 1.

You'll definitely need to assign an IP Address to VLAN 1, either 10.6.0.1 or 10.6.0.254... doesn't make any difference so long as it's in the Class B subnet. And that address will be the gateway address of your static route on the Firewall.

Due to the remote sites and the IP Addressing structure they have it might be nice to stick this new printer VLAN on a different address range, eg. 192.168.1.0 or something... just incase a new site crops up in the future they wouldn't be able to stick it on 10.7.0.0 if the printers are already using it.

So just to completely clarify...

Set an IP in VLAN 1:
ip address 10.6.0.1/24

Enable IP Routing:
ip routing

Create VLAN 2:
vlan 2

You're now in the VLAN 2 context, so any commands apply only to VLAN 2.

Give it a name (if you want):
name "Printers"

Set an IP Address in vlan 2:
ip address 192.168.1.1

Untag your printer ports in vlan 2:
untagged A1

Create a Static Route on the LAN of your Firewall:
Destination 192.168.1.0/24
Gateway 10.6.0.1

So all printers will have an IP of 192.168.1.x with a Gateway of 192.168.1.1

That gateway is the 4108 with routing enabled so the printers can communicate with the rest of the LAN.

All other devices on the LAN continue to have a gateway of the Firewall. But the firewall has a Static Route for the Printer subnet pointing back to the 4108's VLAN 1 address.

Best of luck!
Matt

[NMJR]

I was just reading this tread and I have the same problem. I have a class B network where site A is 10.1.0.0/16, site B is 10.2.0.0/16, site C is 10.3.0.0/16, etc. Our main facility is 10.1.0.0/16 and its default gateway is 10.1.10.1. Clients are 10.1.1.1-254/16 and servers are 10.1.5.1-254/16, printers etc. I want to create VLANs to cutdown on broadcasts within the 10.1.0.0 network:

example
vlan 2 - 10.1.1.0/24 for clients
vlan 5 - 10.1.5.0/24 for servers
etc

As Matt79 suggested to PMcook to create a new VLAN because 10.6.10.0/24 is a subnet of your class B or you will have routing issues.

I have way too many devices on my 10.1.0.0 network go change their IPs. So my question is can i create the VLANs on my Layer 3 switch, and then change over all client, servers to the new class C network with their new gateways and still be able to route information out to the default gateway at 10.1.10.1?