Server on separate Vlan

[jhonrosas]

Greeting,

I have next question about network desing. Today I have network around 400 pcs use services from local servers place in the Datacenter. Some guidelines as Cisco recommend split ther Servers Farm on separate vlan from the pcs, is it useful? o maybe could go in throguh bottleneck on the gateway tha perfomr routing  o there is another better option?.

Other subject, cause the high pcs I would like split the network into few subnets(Vlans), the option the subnet  on the Direectory Active will work or just  that I should be on devices networks?.

In advance for you help.

[Reza Sharifi]

Hi,

Other subject, cause the high pcs I would like split the network into few subnets(Vlans), the option the subnet  on the directory Active will work or just  that I should be on devices networks?.

Active directory will work fine with the sever being in the subnet as the user or not.

As for separate vlans between severs and the users, having separate vlans gives you the ability to make changes to one vlan which can effect only the users and not the servers and vice versa.  For example; You can apply QOS to user vlan and usually that is not needed on the server vlan.. Also, users and/or servers going through the gateway should not create any bottleneck unless the gateway device is very old.

HTH

[Julio E. Moisa]

Hi

By security and network performance reasons the servers and users must not be on the same network and sharing switches either. The recommendation is always separate networks through VLANs it includes the server farm, the communication between VLANs will be accomplished if there is a Layer 3 devices. Cisco has also designed an entreprise campus model, where it displays the best location/connection for each device. 

You can protect your servers using ACLs, VACL or other security methods, in most cases there is a firewall and behind the servers. A good network design includes: scalability, security, easy management, flexible, etc. 

The following links could be useful:

http://www.ciscopress.com/articles/article.asp?p=2202410&seqNum=6

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/vlans.html

http://www.ciscopress.com/articles/article.asp?p=102157 

Hope it is useful

:-)

[Joseph W. Doherty · Accepted solution]

The two main reasons to subdivide a flat network are:  first large L2 networks tend to have performance issues.  This mainly due to broadcast packets being generated by hosts which every other host has to process even though most of the time those other hosts aren't interested in the broadcast packet's contents.  As a general rule of thumb, you want to segment a network once you have more than 256 or 512 hosts.  (Your 400 is boarderline.)

The second main reason is, as the other posters have already noted, there are often admin reasons to split up hosts, often security related.

To your question about performance, and gateway device, on a LAN using a L3 switch is often not a bottleneck.  In some cases, the extra "hop" will very minimally slow your traffic, but in some cases, the segmentation will improve the performance of your traffic.