Request for help with VLAN basics

[RebateMonger]

I'm a bit embarrassed to ask this question, but I would appreciate some help with some VLAN basics. I know zilch about VLANs. They just aren't used in "my world" of small businesses. I'm trying to learn, but I don't have any hardware to play with. I've done some reading on VLANs, but I could use some help.

Somebody asked me for their options for the following scenario:

- This is a school.
- There is a main building and four additional buildings, each with ten classrooms. Each building is connected by a single fiber optic cable to the main building.
- Each building has some Cisco hardware, likely a Cisco router in the main building and switches in the secondary buildings. I don't know the exact equipment or model numbers.
- There are 200 PCs total. Fifty are for teachers/staff, and 150 are for students.

Right now, everybody is on the same physical network. But they want to create two VLANs, one for the 150 student PCs and one for the 50 teacher PCs.

The problem is that the buildings are basically wired for a single network. They come out of the building's Cisco switch and run a single copper cable to each classroom. A simple home-grade switch in each classroom handles all the PCs in that classroom (both teacher and student PCs).

With my VERY limited knowledge of VLANs, it seems they'd have to create a "Teacher" VLAN with the Cisco switches and then run an additional cable from the Ciscos to each classroom to get the teacher PCs onto the separate teacher VLAN.

Is there another option, that wouldn't require adding additional wiring? Are there any other options?

Thanks for any hints.

 

[spyordie007]

That's correct, you could have 2 runs with a "cheap" switch and use one for teachers and one for students. Of course if this is what you're doing there isn't much security since anyone could easily plug into a given switch.

The other option would be to buy new switches for the classrooms, they'd need to be VLAN capable and support 802.1q trunking back to the distribution switches.

VLANs separate out the network at layer 2, so you're going to also need to route between those VLANs and the rest of the world. You'll need a router, etc.

 

[jlazzaro]

http://www.cramsession.com/articles/fil...n-basics---a-look-at-c-992003-0848.asp

http://www.netcraftsmen.net/welcher/papers/switchvlan.html

Originally posted by: RebateMonger
Each building is connected by a single fiber optic cable to the main building.

eek, single point of failure = bad. do they at least have more than 1 fiber ran just in case it were to get damaged? manual redundancy is better than none...

Originally posted by: RebateMonger
With my VERY limited knowledge of VLANs, it seems they'd have to create a "Teacher" VLAN with the Cisco switches and then run an additional cable from the Ciscos to each classroom to get the teacher PCs onto the separate teacher VLAN.

unless the simple home-grade switch in each classroom supports dot1q trunking (doubtful), you are correct. Without dot1q, there is no way for the classroom switch to convey its vlan information back to the Cisco.

 

[RebateMonger]

Thanks, guys, for your help. I haven't had a chance to examine their networking hardware and they don't know much about their network. Maybe I can get to their site and take a close look at their hardware and wiring. It's possible that they DO have more than one cable to each building and just don't know it.

 

[jameswhite1979]

VLAN's are a great way to manage mini newtorks within one network topology. Its not complex at the level you are talking about I have though seen some rather extreme Cisco systems in data centers that are mind blowing. The point being they are very flexable and managable from tiny to large.

 

[cmetz]

RebateMonger, see if your Cisco core switches support MAC based VLANs. Maybe you can run the classrooms themselves with the two L2 broadcast domains combined, and then separate the traffic into VLANs up at the core level. Then use different IP subnets for the VLANs so the machines can't talk IP directly.

It won't give you security. Emphasize this point. It's very defeatable given a sophisticated attacker. But if you have no money and assume most people aren't sophisticated attackers, it might help.