Re: Switch w/ VLANs at the Edge Question

On Feb 19, 5:02 pm, tman <naves....@xxxxxxxxx> wrote:
On Feb 19, 11:57 am, Trendkill <jpma...@xxxxxxxxx> wrote:



On Feb 19, 12:56 pm, tman <naves....@xxxxxxxxx> wrote:

I have several switches in my public network each connecting two or
three devices on seperate networks. I thought it would be a good idea
to consolidate them into one switch with a VLAN for each network with
no interVLAN routing. I can't find any information that I can
understand. I was wondering if anyone does this and how to make it
secure.

Thanks.

Essentially you are talking about creating the vlans centrally, using
VTP to propagate out the VLANs, using your existing routers to service
those networks (or perhaps consolidate those as well to a central l3
switch or router). This isn't that difficult, and it depends if you
are consolidating onto a catalyst or ios based switch for config
references. You also would need to control 'security' at the
routers. If you don't want traffic between subnets, you'll need to
ensure that you aren't advertising the networks between you routers,
or you have access-control lists if you are routing centrally.

My plan is to use one switch that has one VLAN to connect every pair
of devices. Each pair of devices is in on a separate network. Each
port will be configured as an access port e.g. switchport mode
access. There will be no connections from this switch to any other
switches, thus no need for trunks. I am replacing several small
switches. The switch is a Catalyst switch with IOS.

Your comments will be welcomed.

Thanks

Well, you can't use one vlan to merge layer 3 networks. I guess
technically you can have one vlan, and the boxes will only be able to
talk to other boxes in the same layer 3 address range, but all boxes
would see broadcasts, etc, and it would be very bad practice.
Additionally, if you ever need to route externally, this could get
very very nasty. Perhaps I misunderstood your requirements, but I
would connect all boxes to the switch, create vlans for each subnet,
and lets the router(s) control security via ACLs.

If this is indeed not routing anywhere else, you can look into vlan
security, and use things like private vlans. Generally this is for
nodes that are all in the same layer 3 network, but you want to
protect them from one another and only allow communications within a
group or with the gateway. Here is a link.

http://www.informit.com/articles/article.aspx?p=29803&seqNum=6
.

Relevant Pages

  • Re: Catalyst 3750 with 2 vlans. Only vlan1 drop packet when ping
    ... when I ping to the ip onvlan1, about 10% come back with "Request ... Are you pinging the hsrp vlan 1 address, ... ping vlan 140's interface with no problems? ... how does the other switch know how to get ...
    (comp.dcom.sys.cisco)
  • Re: Catalyst 3750 with 2 vlans. Only vlan1 drop packet when ping
    ... when I ping to the ip onvlan1, about 10% come back with "Request ... Are you pinging the hsrp vlan 1 address, ... ping vlan 140's interface with no problems? ... how does the other switch know how to get ...
    (comp.dcom.sys.cisco)
  • Re: Need guidance on Cisco 6513 install
    ... having this switch set up on Tuesday by noon, ... The switch itself (and other future network hardware) will be on the ... but you can always choose another vlan number and same ... In a two core environment, ...
    (comp.dcom.sys.cisco)
  • Re: bond interface arp, vlan and trunk / network question
    ... So far vlan and trunking works as expected. ... The exact problem is that the bonding driver don't switch the ... interface because the mii-tool don't recognize that the connection ... No, from your configuration information, you're running the ARP ...
    (Linux-Kernel)
  • Re: Switch w/ VLANs at the Edge Question
    ... three devices on seperate networks. ... VTP to propagate out the VLANs, using your existing routers to service ... switch or router). ... you can't use one vlan to merge layer 3 networks. ...
    (comp.dcom.sys.cisco)