- Posts: 24
- Thank you received: 0
VLAN Configuration issue!
Well i m planning to set up a VLAN in my company, the whole network will be divided into 7 segments of seperate subnets(172.16.1.x to 172.16.7.x) where 172.16.7.x is the common VLAN having shared resource which can be accessed by all. But now i m facing 2 issues:
1. The dhcp server is not able issue ip addresses to the VLAN usng scopes.. i do kno tat i can configure a L3 switch(on which im doin this VLAN configuration) to act as a DHCP. but i don want to do so. i prefer a seperate DHCP server. but the L3 switch is not allowing the DhCP to assign Ip addresses?? Y is it so??
2. I do have some critical servers in my network whose ip adresses i don wish to change, now is it possible to config VLAN without changing the IP addresses of this servers and yet place them in the respective VLAN(eg: can i place a server having IP 172.16.3.5 in the 172.16.5.x subnet without changing the IPs)
I donot have much experience in VLAN, hence my questions may sound simple or stupid..But i stil hope u cud help me
Thnx in advance
NetIvy
Live life lik ters no tomrw!!!
Hi All,
Well i m planning to set up a VLAN in my company, the whole network will be divided into 7 segments of seperate subnets(172.16.1.x to 172.16.7.x) where 172.16.7.x is the common VLAN having shared resource which can be accessed by all. But now i m facing 2 issues:
Can i ask the reason why you want the 7 segments ? Is this because of the volume of machines that are now occupying your network ? VLAN'ing is a great idea if you want to seperate the boadcast domains to improve network performance, to segment the traffic flows so you can more easily control them though access-lists or for ease of management by segmenting different roles (links in with controlling the traffic flows)
1. The dhcp server is not able issue ip addresses to the VLAN usng scopes.. i do kno tat i can configure a L3 switch(on which im doin this VLAN configuration) to act as a DHCP. but i don want to do so. i prefer a seperate DHCP server. but the L3 switch is not allowing the DhCP to assign Ip addresses?? Y is it so??
Don't fully understand this ? Are you saying that you want a seperate DHCP Server per segment ? Anyhow, just to explain a little more detail for you. DHCP uses a broadcast method to aquire an IP Address. The whole idea of Layer 3 segmentation is to segment the broadcast domain into smaller ones by seperating the different IP Subnets via routers (or Layer 3 switches that are routing between different vlan's "InterVLAN Routing"). This is good and is the main reason for having seperate subnets.
If you only have the one DHCP server (and cannot have 1 per subnet), then you can use a Relay Agent which will sit on each ip subnet segment, listen for the DHCP broadcast and forward this onto a specified DHCP server. Some switches and routers can provide this functionality for you, otherwise you can get Windows Servers that will also have DHCP Relay Agents that can provide this functionality.
2. I do have some critical servers in my network whose ip adresses i don wish to change, now is it possible to config VLAN without changing the IP addresses of this servers and yet place them in the respective VLAN(eg: can i place a server having IP 172.16.3.5 in the 172.16.5.x subnet without changing the IPs)
The answer to this is no. If you have a machine on one VLAN and a respective IP Subnet, the machine will have to be on the same ip range in order to talk on the network and more of the point, in order to route through the VLAN's to others.
Wayne Murphy
Firewall.cx Team Member
www.firewall.cx
Now working for a Security Company called Sec-1 Ltd in the UK, for any
Penetration Testing work visit www.sec-1.com or PM me for details.
Wat i had in mind was to use one DHCP over the 7 segments, with a relay agent switch per segment to forward the broadcasts.. but now i think the problems lies with the relay agents some were. if nothin works i ll jus drop the idea and use the L3 switch as DHCP and try.
Thanx a lot once again
NetIvy
Live life lik ters no tomrw!!!
Cheers
Wayne Murphy
Firewall.cx Team Member
www.firewall.cx
Now working for a Security Company called Sec-1 Ltd in the UK, for any
Penetration Testing work visit www.sec-1.com or PM me for details.
192.168.3.x, etc..
you would setup the ip helper address for each vlan to be 192.168.1.5, then for any DHCP requests they are automagically forwarded to the proper host issuing ip's
regarding the server, yes if you use either a trunk (cisco terms) or have the servers use tagged ports which allow traffic from unique vlans to carry to a specific port (i.e. your server port) in order to use this feature you would have to be sure that your NIC card in the server supports 802.11q tagging and that it is enabled. else those machines in different vlans will not be able to reach the server.