0

I work at a school with several campuses and I would like to segment my network with VLANs. So, phones on one vlan, printers on another, etc. I was thinking it would be nice to segment by campus, as well. That seems like it would be some sort of nested vlan where there is a vlan for the High School, and then for the phones in the HS, and so on.

Other than nested vlans, I thought about making the trunks only listen for traffic for their campus.

Is that possible, and if so, how do I implement it? Or, will I have to make a separate vlan space for each segment in each campus (like, HS printers, MS printers, Elem Printers, etc)? I'm still a newbie with vlans, but slowly learning.

John Beavers
  • 3
  • 2
  • So you're just spit-balling ideas? Just doing it for the sake of doing it? What are the actual needs and the desired outcome? Why do you want to do this? What's the actual purpose or goal? – joeqwerty Sep 10 '21 at 14:47
  • 1
    **I was thinking it would be nice to segment by campus** - It might be nice? That's your reason for doing it? Is that a business need? A security need? Don't do things because you can or because you think you should. You should have a defined purpose for doing it. Know why you're doing it, then do it. – joeqwerty Sep 10 '21 at 14:50
  • We're doing it for security reasons, to segment the lan in an attempt to mitigate intrusion attacks. Also, limiting the broadcast area would be desirable. – John Beavers Sep 10 '21 at 14:58

2 Answers2

2

Nested VLANs are a thing, but they're like building a tunnel inside a tunnel, and you'd have to have equipment that can support it (and licensing if required). A better method is to assign a specific subnet to a specific campus, then mirror your VLAN allocation across subnets. This would allow consistent VLAN usage across multiple campuses, while localizing traffic to specific subnets/campuses. It's also cleaner and natively supported on all layer 2 switches.

E.g.

enter image description here

CIA
  • 1,604
  • 2
  • 13
  • 32
  • Okay, my vlans are given their own address space, like vlan 10 = 10.10..0, with your scenario, would each vlan on the different subnets need their own address space? – John Beavers Sep 10 '21 at 14:45
  • You can bump up the subnet class to 10...0/24. – CIA Sep 11 '21 at 15:13
2

Nesting VLANs isn't really necessary and it's way overkill in your scenario.

You should use routed links between locations, not switched links. That way, VLANs don't span across locations at all, allowing you to re-use their IDs. However, I wouldn't recommend doing so - it's generally a good idea to not duplicate VLAN IDs but use a common scheme.

For instance, you could use VLAN 110 on location 1 and VLAN 210 on location 2 for the same purpose. That way, you could use a common VLAN plan across locations if that became necessary. Using duplicate IDs for distinct subnets would force you to renumber the VLANs which isn't much fun.

Regarding it would be nice to segment by campus - you shouldn't do so because it's nice or because you can. You should do so to improve network security. Plan for different security zones - like VoIP, physical security (electronic doors, alarm systems), servers, storage, staff access, students access, IoT devices, ... and use VLANs to separate those zones. Configure strict firewall rules between the zones to control the routing in between. Start with denying all traffic as default and only permit was is really required. Document well.

Zac67
  • 10,320
  • 2
  • 12
  • 32
  • 1
    Just to add to Zac67's answer: VLANs alone provide **NO SECURITY**. You need ACLs or a firewall BETWEEN the VLANS to enforce your security policies. – Ron Trunk Sep 15 '21 at 12:38