Home / server / Questions / 804419
Accepted
Riccardo
Asked: 2016-09-22 01:45:12 +0800 CST

Multiple VLANs, one server - Minimum required equipment

  • 772

A small school has currently 30 PCs connected through wifi access points to the internet (3 WANs), but there's no real LAN at the moment, apart from about 8 cables running from the APs to the modems. Finally the plan is to: - buy a switch 24p - buy a Windows Server 2012 - buy a network failover/balacing bandwidth aggregator

Scheme:

-----------          ----------           ------------           ----------------- 
| 5 VLANs | <------> | Switch |  <------> | Failover |  <------> |  3 modems     |
-----------          ----------           ------------           -----------------

Requirements:

  • Each VLAN may access the Windows Server 2012 (file server, shared folders)

Questions:

  1. Is a managed L2 switch sufficient for this task?
  2. Does the server needs multiple NICs?
vlan switch windows-server-2012

1 Answers

  1. Best Answer

    Answers to original questions:

    1. A managed L2 switch with 802.1q VLAN support is sufficient if all routing between subnets is done on another system (your router or your server or another machine with a 802.1q compatible NIC and software). If you want to route on the switch, you have to buy a L3 enabled switch. It depends mostly on your performance needs (single system would be bottleneck, as all traffic from all ports has to go through it).
    2. As long as the NIC supports 802.1q VLAN tags, you can do it with a single NIC. Depending on operating system it might be easier to configure different NICs, and the cost of the hardware is relatively low. It also depends on your traffic patterns whether 4 single NICs or 4 aggregated NICs are more efficient.

    Do VLANs help with security?

    • They can help by segregating traffic into different subnets, but it should be combined with other things. For example, when using 802.1q and 802.1x (RADIUS), a new device can authenticate itself (by password or certificate) upon first contact (via wireless or cable) and will then be assigned to a VLAN depending on your set-up rules (guest VLAN, teacher VLAN etc.). Similarly, if you combine them with IPSec or any other VPN solution, you have encrypted traffic and even in the same subnet nobody can read/understand traffic not intended for him. You can and should combine different technologies.
    • There exist attack scenarios where the goal is to break out of a VLAN (by bug/exploit or by exploiting badly configured VLAN setups). As long as you configure your VLANs correctly, you will most likely be fine. Very sensitive information could still be managed separately (air gap or with separate hardware) if you like.
    • There is overhead in management and configuration, so you should decide if it is worth your time to configure it correctly. You get the most out of it if your desired network topology
      • changes frequently, but hardware remains fixed, or
      • is complicated and different to your physical layout, or
      • is impossible to model physically.
    • 4