11-24-2015 02:27 PM - edited 03-08-2019 02:49 AM
Hello All,
I recently started at a company that has two physical network segments 192.x.x.x/24 and 10.x.x.x/24. They both connect to shared NAS devices that have dual NICs in them. Recently I installed a Windows 2012 r2 server running on the 10.x.x.x/24 network. I want to add the 192.x.x.x/24 devices to the 10.x.x.x/24 network and have the server serve out the IP address using DHCP then use VLAN to virtually segment the network so that there is still the seperation of the networks. If I can do it this way it will allow all network devices to be seen by the server for management purposes yet keep one side from seeing each other.
I was envisioning VLAN 1 as the Server/Management device group(currently on the 10.x.x.x/24 subnet), VLAN 100 10.x.x.x/24 (keeping 10.x.x.x/24) group, and VLAN 200 192.x.x.x/24 (Migrated to 10.x.x.x/24). Allowing VLAN 1 and VLAN 100 to communicate and VLAN 1 and VLAN 200 to communicate but VLAN 100 and VLAN 200 would not be able to communicate.
This may be easier to understand:
Ports 1 - 11 VLAN 1
Ports 12 - 18 VLAN 1 & VLAN 100
Ports 19 - 24 VLAN 1 & VLAN 200
I have read some contridictory information on single subnet multiple VLANs and I want to make sure I get the right scoop on the subject. If it is not possible to do what I am envisioning my question would than be; How should the VLANs and DHCP server be setup so as to allow both sets of comptuers to share the server and NAS device while maintaining the segmentation that we currently have.
Thanks in advance for any help.
Trey
11-24-2015 02:53 PM
Hi,
Usually best practice is to assign a vlan per subnet and not multiple vlans per subnet.
so, for example:
vlan10 10.10.10.0/24
vlan20 10.10.20.0/24
vlan30 10.10.30.0/24
and so on.
This way you can use access list to block communication between vlans if you need to.
Also, it is best practice not to use vlan 1 and shut it down.
HTH
11-27-2015 08:10 AM
Hello ,
Echo with Reza comment, better to have separet subnet for each VLANs and assign ports to respective vlan for better communication.
SO that it is easy to apply policy based on in ACLS or other policy based features.
Hope it Helps..
-GI
Rate if it Helps..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide