VLAN Segmentation

[haggittmark@tm-america.com]

We are a manufacturer, so we have PLCs that do much multicasting.  Sometimes a PLC message doesn't get to a computer or database in time.  I believe we are having timeouts.  
I have many VLANs for different hardware or usage types, but I don't think they are segmenting the traffic the way I thought they should.  For instance, if I put wireshark on a computer, I can see conversations on other vlans.  I think in ignorance, I have just been making VLANs without making routing rules.  We have a core stack of Cisco 3850 Layer 3 switches.  Can I make the type of rules I need to to separate VLAN traffic so that the network can send packets in a timely fashion?

[haggittmark@tm-america.com]

Solarwinds is showing lots of timeouts too.

[haggittmark@tm-america.com]

Also, I can ping any host on any other VLAN.

[balaji.bandi]

You need to start collecting information - where is PLC connected, where the message trying to send end device, how far what is the path to reach source and destination., how many network device in the path. what errors you see them

PLC most of them i observed was 100MB, so try to set up a port 100MB and see if that improves, if not post your network topology along with configuration to understand along with interface output.

[haggittmark@tm-america.com]

I added a bunch of Information.

[Aref Alsouqi]

Creating VLANs on the switches provides L2 segregation between the broadcast domains, you can still route between the VLANs by enabling routing on the core or by using a downstream router.

You should not see the traffic of other VLANs on a switch port configured in access mode. How the switch ports are configured? Do you see any CRCs/errors on the switch ports? did you check if the switches CPUs are high?

[haggittmark@tm-america.com]

I added a bunch of information.

[MHM Cisco World]

this solved by config QoS, 
this make your PLC multicast have priority than other traffic.
segment VLAN not very useful here. 

[paul driver · Accepted solution]

Hello

"I think in ignorance, I have just been making VLANs without making routing rules. We have a core stack of Cisco 3850 Layer 3 switches. Can I make the type of rules I need to to separate VLAN traffic so that the network can send packets in a timely fashion?"

Few things you can do before you think about applying any QOS  design (if you dont already have it).

• Manually apply prunnng to all your trunk interconnects to allow only the vlans that need to traverse the interconnect.
• Enable dhcp-snooping on all access switches, and If you have lan multicast enable igmp snooping also.
• On all access-ports (edge ports) apply -stp portfast, bpduguard & storm-control for broadcast/multicast/unicast

[haggittmark@tm-america.com]

Can IGMP Snooping and proxy be enabled on a layer 3 routing enabled switch?  We don't have a true router.

[haggittmark@tm-america.com]

What would happen if I just enabled VLAN Pruning (not manually)?  Would there be downtime and would it be long?

Experts Exchange is also recommending IGMP Snooping.  Is that a good idea?

[paul driver]

Hello
I wouldn't enable pruning dynamically as it isn't deterministic enough, If you have to prune vlans off trunks suggest you do this manually.

As for IGMP snooping, as stated previously if you have Lan multicast I would enable this also.

[haggittmark@tm-america.com]

All the PLCs are on the same VLAN.  The the switch trunks are on the default VLAN.  We are using VTP.  What exactly would I show you?  Our map doesn't really show which switches are just for PLC's cause most of the switches have PLC, computer, phone, printer, access points all mixed together.  Maybe a sh int status or an example of o trunk, or sh int sum?

So, will VLAN Pruning and IGMP help? And including the commands below on each trunk?
spanning-tree portfast disable
 spanning-tree bpduguard disable
We are very sophisticated here.  15 years ago this network was set up for a small business, and we are now a big medium business without much network change.  I am more or less a novice.

[haggittmark@tm-america.com]

I added a bunch of information.

[haggittmark@tm-america.com]

If the following can be done, would applying "switchport trunk allowed vlan aaa, bbb, ccc" to a trunk between switches help reduce the number of VLANs passed to a switch that only needed certain VLANs?  While applying that command to both sides of the trunk (both connected switches) would traffic be temporarily interrupted?  If I am also using a port channel on that trunk, would I also add that command to the port channel (or perhaps just the port channel)?