Tuesday, January 5, 2021

Segmenting the network of a campus and need some tips

Hey r/

I'm in the process of designing the segmentation of the campus network and just want to confirm I'm on the right path.

The campus has currently over 1200 students and 300 teachers. All of them will be required to bring a notebook with them for class, since the school wants to introduce a BYOD policy. So I have around 1500 laptops and for argument sake, just as many smartphones. Guests arrive at the campus, fixed computers will be added to the campus, so basically a lot of devices.

I've read on some best practices on VLANs and Subnets and there are some posts stating to never go below /22. Since you never need that many devices in one subnet. In the end, we decided that since the campus has 12 buildings, and we have 1500 people, a /22 would suffice. Since the users are spread over the campus. I've read on reddit that one network engineer faced problems, since students would gather at a building where they would not have classes, and turn on their laptops, getting a DHCP IP from that network which caused the IP lease to run out of free IP leases, even with a 2 hour IP lease. So I was rather thinking of using a /20 ?

To keep it simple, I wanted to segment the networks as follows, and for argument sake, lets keep the /22 for now.

  • Students - address block 10.1.0.0/16 with a subnetmask of /22
  • Management - address block 10.2.0.0/16 with a subnetmask of /22
  • Servers - address block 10.3.0.0/16 with a subnetmask of /22
  • Teachers - address block 10.4.0.0/16 with a subnetmask of /22
  • Guests - address block 10.5.0.0/16 with a subnetmask of /22
  • ...

This would mean that I would have 64 subnets of an address block and 1024 hosts per subnet.

I was looking into multiple DHCP pools / subnets per VLAN, and while it is possible, it is not recommended. I was also not sure on how to route the different subnets per vlan, so I'm assuming I need to go a level deeper in this?

Instead of assigning the address block VLAN 10, I want to assign each subnet a VLAN for easier management

Since every VLAN has its own range, I need to define all these ranges in a Windows Server DHCP role, assign intervlan routing so that the entire "student" vlan range can talk to each other and printers.

Or should I just whip out a /16 and have huge broadcast domains since most devices and programs tend to go to multicasts rather than broadcasts?



No comments:

Post a Comment