Join Log in
Score:0
John Beavers avatar Server

Can I segment my network based on two different criteria?

de flag
John Beavers

I work at a school with several campuses and I would like to segment my network with VLANs. So, phones on one vlan, printers on another, etc. I was thinking it would be nice to segment by campus, as well. That seems like it would be some sort of nested vlan where there is a vlan for the High School, and then for the phones in the HS, and so on.

Other than nested vlans, I thought about making the trunks only listen for traffic for their campus.

Is that possible, and if so, how do I implement it? Or, will I have to make a separate vlan space for each segment in each campus (like, HS printers, MS printers, Elem Printers, etc)? I'm still a newbie with vlans, but slowly learning.

81
0 + 0
joeqwerty avatar
cv flag
joeqwerty
So you're just spit-balling ideas? Just doing it for the sake of doing it? What are the actual needs and the desired outcome? Why do you want to do this? What's the actual purpose or goal?
0
Reply
joeqwerty avatar
cv flag
joeqwerty
**I was thinking it would be nice to segment by campus** - It might be nice? That's your reason for doing it? Is that a business need? A security need? Don't do things because you can or because you think you should. You should have a defined purpose for doing it. Know why you're doing it, then do it.
1
Reply
John Beavers avatar
de flag
John Beavers
We're doing it for security reasons, to segment the lan in an attempt to mitigate intrusion attacks. Also, limiting the broadcast area would be desirable.
0
Reply
Score:2
CIA avatar Server
ae flag
CIA

Nested VLANs are a thing, but they're like building a tunnel inside a tunnel, and you'd have to have equipment that can support it (and licensing if required). A better method is to assign a specific subnet to a specific campus, then mirror your VLAN allocation across subnets. This would allow consistent VLAN usage across multiple campuses, while localizing traffic to specific subnets/campuses. It's also cleaner and natively supported on all layer 2 switches.

E.g.

enter image description here

0 + 0
John Beavers avatar
de flag
John Beavers
Okay, my vlans are given their own address space, like vlan 10 = 10.10.<vlanid>.0, with your scenario, would each vlan on the different subnets need their own address space?
0
Reply
CIA avatar
ae flag
CIA
You can bump up the subnet class to 10.<campus>.<vlan>.0/24.
0
Reply
Score:2
Zac67 avatar Server
ru flag
Zac67

Nesting VLANs isn't really necessary and it's way overkill in your scenario.

You should use routed links between locations, not switched links. That way, VLANs don't span across locations at all, allowing you to re-use their IDs. However, I wouldn't recommend doing so - it's generally a good idea to not duplicate VLAN IDs but use a common scheme.

For instance, you could use VLAN 110 on location 1 and VLAN 210 on location 2 for the same purpose. That way, you could use a common VLAN plan across locations if that became necessary. Using duplicate IDs for distinct subnets would force you to renumber the VLANs which isn't much fun.

Regarding it would be nice to segment by campus - you shouldn't do so because it's nice or because you can. You should do so to improve network security. Plan for different security zones - like VoIP, physical security (electronic doors, alarm systems), servers, storage, staff access, students access, IoT devices, ... and use VLANs to separate those zones. Configure strict firewall rules between the zones to control the routing in between. Start with denying all traffic as default and only permit was is really required. Document well.

0 + 0
Ron Trunk avatar
in flag
Ron Trunk
Just to add to Zac67's answer: VLANs alone provide **NO SECURITY**. You need ACLs or a firewall BETWEEN the VLANS to enforce your security policies.
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.