Network Segmentation - VLAN Plan

Hello

You may proceed as follows:

• Prepare the interfaces and SSIDs at firewall level, without setting IP at the moment 
• Prepare the firewall policies for the new segments
• Schedule a 1h downtime
• Change the FG interface of client VLAN from /16 to /22
• Change it's DHCP range
• Run DHCP refresh on all your clients so they change their mask to /22
• Configure IP on the FG interfaces of IoT and printers
• Move IoT and printers to the new VLAN and/or SSID
• Perform all validation tests (ping, print, ...etc)
• Rollback in case of failure

Hi @Infotech22,

We have the following segmentation in place, all in 10.n.n.n ranges.

Site, Service(vlan).

Logically, that translates to IP ranges: 10.[SITEID].[VLAN].0/subnet

So you can make sites like:

0: Hosting1

1: Hosting 2

11: Site1

12: Site2

etc..

VLANs like:

10-19: HighTrusted internal services (Domain joined stuff, etc)

20-29: LowTrusted internal devices (IoT, Printers, CCTV,... )

30-39: VoIP stuff

40-49: Low trust external stuff (CTS etc)

xx: In-Band management of network devices (switches, UPS, 

xxx: IPTV Multicast stream (if used)

Defining trust zones, makes it easy to group VLAN's and handle it easier in interface zones and policies.

You then get ip's like:

10.0.10.xxx: Servers in hosting..

10.11.10.xx: Trusted devices on site 1

10.12.31.xx: VoIP devices on site 2

Even if you only have one site now, if you suddently need a new site, you have the logic in place.

And - trust me - looking at logs and Analyzer data makes it soooo easy to spot where the traffic comes from and to.

Tip1: If you need ranges larger than /24, don't use the next vlan, since that vlan's IP's will be part of the former /23 vlan's range.

Tip2: Don't use 192.168.n.n ranges, for VLAN's you like to route internally, since many ISP's use those for peoples home-networks.
You can use those ranges for guest-related wifi, if needed. We use that for none-site-specific hospitality wifi networks.

Hope it helps,

Hello,

As we understood you have already working Vlan subnets which needs to be modified .

Best way is to create Vlan but do not assign IP for the moment (put unused dummy ip).

However as you mentioned you already have static addresses on Printer and other devices.

For those devices it would require downtime as they are already setup with a particular subnet mask.

Also you need to make sure about your static Bindings , so better you do it in downtime .

Thank you.

Regards,

Prince

Your plan to restructure your network into more granular VLANs is a sound strategy for improving network management, security, and performance. Here's a step-by-step approach to make the transition as smooth as possible:

1. **Planning and Documentation**:
- Begin by documenting your current network structure, including all devices, their roles, and IP addresses.
- Plan your new VLAN structure meticulously, including the purpose of each VLAN, the range of IP addresses, and the necessary policies and security measures.

2. **Pre-Configuration Steps**:
- Before making changes, ensure that you have a full backup of your current network configuration.
- Notify all users about the planned changes and potential downtimes.

3. **Creating New VLANs**:
- Initially, create the new VLANs (for Printers and IoT) in your network switches without altering the existing VLAN_Clients.
- Configure the IP ranges for the new VLANs as planned (10.10.255.0/24 for Printers and 10.10.10.0/24 for IoT).

4. **Reconfiguring the Client VLAN**:
- Adjust the subnet mask of VLAN_Clients from /16 to /22. This change will need to be done on your DHCP server, routers, and any statically assigned devices.
- Make sure to update the DHCP scope to reflect the new subnet mask.

5. **Migrating Devices**:
- For Printers:
- Since printers are often assigned static IP addresses, you will need to reconfigure each printer’s network settings to the new IP range and VLAN.
- This step can be time-consuming but is crucial for avoiding IP conflicts.
- For IoT Devices:
- If these devices receive their IP addresses via DHCP, ensure your DHCP server is set up to serve the new VLAN with the appropriate address range.
- Manually reassign static IP addresses if necessary.

6. **Testing and Validation**:
- After reconfiguring, test each VLAN to ensure devices are communicating correctly.
- Verify that network policies and security measures are functioning as intended.

7. **Updating Network Policies and Routes**:
- Update your firewall rules, ACLs (Access Control Lists), and other network policies to reflect the new VLAN configurations.
- As for the static routes, you're correct that routes to 10.10.0.0/16 will still capture traffic destined for your new subnets due to the nature of route summarization. However, you might need to adjust any policies or rules that are specific to subnet addresses.

8. **Monitoring and Troubleshooting**:
- After implementation, monitor the network closely for any unusual activity or performance issues.
- Be prepared to troubleshoot issues related to the new VLAN configurations, such as connectivity problems or misconfigured devices.

9. **Communication**:
- Keep stakeholders updated on the progress and any issues encountered during the transition.
- Provide support and instructions for users as needed, especially if network changes affect their daily operations.

Remember, significant network changes like this can often lead to unexpected issues, so it's important to have a rollback plan in case things don't go as expected. Additionally, carrying out these changes during off-peak hours can minimize the impact on your organization.