VLAN Design

[chestes]

Hello Fellow Experts,

Are there any Cisco documents that implicitily recommend the use of smaller subnets over larger ones? i.e. VLAN Design Best Practices

Aside from the obvious benifits, can anyone think of other advantages other then the following:

A. Smaller Broadcast, Bandwidth, Failure Domains

B. Less impact to STP BPDU on large (flat) L2 networks where timely receipt of BPDU's is important. (LAN)

C. Less impact to wired and wireless client machines that must listen to broadcast/multicast traffic. 

D. Increased granularity when defining ACL, QoS & Security Policies through increased VLAN segmentation (i.e. smaller subnets) 

E. Increased performance through VLAN segmentation of network traffic/isolation of traffic types into smaller subnets.

In addition, there might be alternate reasons why keeping a subnet/VLAN small. While reviewing some Cisco documentation, I discovered the following:

Examples: of why the switches may not receive BPDUs include bad transceivers or Gigabit Interface Converters (GBICs), cabling issues, or hardware failures on the port, the linecard, or the Supervisor engine. One frequent reason for STP failures is a unidirectional link between the bridges. In such a condition, one bridge sends BPDUs, but the downstream bridge never receives them. STP processing can also be disrupted by an overloaded CPU (99 percent or more), because the switch is unable to process received BPDUs. BPDUs can be corrupted along the path from one bridge to the other, which also prevents proper STP behavior.

Aside from the forwarding loops, when no ports are blocked, there are situations when only certain packets are incorrectly forwarded through the blocking ports. In most cases, this is caused by software issues. Such behavior might cause “slow-loops.” This means some packets are looped, but the majority of the traffic is still flowing through the network, because the links are probably not congested.

http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/28943-170.html#stp_fails

STP Path Cost Automatically Changes When a Port Speed/Duplex Is Changed

STP calculates the path cost based on the media speed (bandwidth) of the links between switches and the port cost of each port forwarding frame. Spanning tree selects the root port based on the path cost. The port with the lowest path cost to the root bridge becomes the root port. The root port is always in the forwarding state.

If the speed/duplex of the port is changed, spanning tree recalculates the path cost automatically. A change in the path cost can change the spanning tree topology.

If auto negotiation fails, and STP re converges. If re-convergence does not occur rapidly enough, the segment will goe down until STP reconverges.  

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

In an effort to prove my point further, I would like to propse a risk management related question:

Q: Would you rather have an outage that affects 254 users or 1024?

A: You tell me?

Q: What are implications to wireless subnets that are 1024 or larger?

Q: What size subnet would you deploy for your WLAN's and WHY?

Aside from what I have already thought of, I would like to here from other experts 

Thanks,

Christian

[Mike Williams · Accepted solution]

Hi Christian,

Those are all great points. From my experience, I have subnetted many /20 and larger networks due to unicast and broadcast flooding. As the subnet gets larger, the number of broadcast, ARP, and unicast packets increase on that subnet. This causes delays, potentially congestion, and delays with mac address discovery and STP. Granted, this is still not much of an issue when you only have 254 hosts, but if you have 1000 hosts, it starts to cause problems.

To answer your questions:

1. I personally would rather have an outage only affecting 254 users. If a loop is formed accidentally, the smaller the outage the better.

2. Wireless is tricky because you want to keep the number of SSIDs and the subnet size as low as possible. However, since enterprise wireless handles broadcasts and ARP much differently than wired networks, the larger subnets are not typically as big of a problem.

3. I typically deploy a /24 unless the requirements call for a larger subnet. Typically I end up deploying FlexConnect mode which keeps the subnets small and minimal SSIDs. I also don't allow static IPs on the wireless in case that subnet needs to change.

With that all said, things change when you start talking IPv6. Since IPv6 uses multicast instead of broadcast, the number of hosts on a subnet become much less important. However, I still prefer to deploy VLANs as a way of organizing my network (i.e. East wing has a VLAN and West wing has a separate VLAN) for troubleshooting, as well as for security. 

Regards, 

Mike