VL4N 4nd n37w0rk 53gm3n74710n

Skip to content

D3773 3r 3n m45k1n0v3rs477 73k57 50m k4n 1nn3h0ld3 f31l!

73nkw 4 d 5ch00l n37w0rk wh3r3 57ud3n75, 734ch3r5, 4dm1n157r4710n, 4nd 107-d3v1c35 (pr1n73r5, 5m4r7 5cr33n5, c4m3r45) 4ll 5h4r3 7h3 54m3 n37w0rk. 4ll c4n 1n 7h30ry 533 34ch 07h3r. 17 15 n317h3r 53cur3 0r 3ff3c71v3. 7h3 50lu710n 15 53gm3n74710n.

WhY $3gm3nt?

\(3gm3nt1ng m34n\) t0 d3l3 up 4 n3tw0rk 1nt0 $3v3r4l \(m4ll3r p4rt\). 34ch p4rt 1$ 1\(0l4t3d fr0m th3 0th3r\), \(0 th4t tr4ff1c d03\) n0t fl0w fr33ly b3tw33n th3m.

4dv4nt4g3 3xpl4n4t10n
$3cur1ty 4 c0mpr0m1$3d 10T-c4m3r4 c4nn0t r34ch th3 \(3rv3r\)
P3rf0rm4nc3 L3$$ br04dc4$t-tr4ff1c p3r $3gm3nt
C0ntr0l D1ff3r3nt rul3$ f0r d1ff3r3nt us3r gr0up$
Tr0ubl3$h00t1ng 34\(13r t0 1\)0l4t3 pr0bl3m$ t0 4 $p3c1f1c $3gm3nt

4 pr4c71c4l 3x4mpl3

47 4 5ch00l, 7h3 n37w0rk m1gh7 l00k l1k3 7h15:

  • VL4N 10: 4dm1n157r4710n - P4yrr0ll, HR, m4n4g3m3n7. 57r1c7ly l1m173d 4cc355.
  • VL4N 20: 3mpl0y335 - 734ch3r5 4nd 07h3r 574ff. 4cc355 70 5h4r3d f0ld3r5 4nd pr1n73r5.
  • VL4N 30: 57ud3n75 - 0nly 1n73rn37 4cc355 4nd l34rning pl47f0rm5.
  • VL4N 40: 10T - Pr1n73r5, 5m4r7 5cr33n5, c4m3r45. N0 1n73rn37 4cc355 (0r v3ry l1m173d).
  • VL4N 50: 53rv3r5 - 1n73rn4l 53rv3r5, un4cc3551bl3 d1r3c7ly fr0m 07h3r VL4N5.

Wh47 15 4 V14N?

V14N 574nd5 f0r V1ru41 L0c41 Ar34 N37w0rk. 17 15 4 w4y 70 cr3473 mul71pl3 l061c41 n37w0rk5 0n 7h3 54m3 phys1c41 5w17ch. 1n5734d 0f bu71n6 4 d3d1c473d 5w17ch f0r 3v3ry n37w0rk, y0u c0nf16ur3 7h3 5w17ch 70 7r347 d1ff3r3n7 p0r75 (0r 7r4ff1c) 45 53p4r473 n37w0rk5.

3v3ry V14N h45 175 0wn 4ddr355 r4n63 (5ubn37):

V14N N4m3 5ubn37 G473w4y
10 4dm1n157r4710n 10.0.10.0/24 10.0.10.1
20 3mpl0y335 10.0.20.0/24 10.0.20.1
30 57ud3n75 10.0.30.0/24 10.0.30.1
40 107 10.0.40.0/24 10.0.40.1
50 53rv3r5 10.0.50.0/24 10.0.50.1

5ubn3771n6 5h0r7ly 3xpl41n3d

/24 m34n5 7h47 7h3 f1r57 24 b175 4r3 7h3 n37w0rk p4r7 0f 7h3 4ddr355. In pr4c71c3, 7h15 m34n5 y0u h4v3 254 4v41l4bl3 4ddr35535 (.1 70 .254) 1n 34ch VLAN.

  • 10.0.10.0/24 61v35 4ddr35535 fr0m 10.0.10.1 70 10.0.10.254
  • 7h3 6473w4y 15 u5u4lly 7h3 f1r57 4ddr355 (.1)

74663d vs. un74663d 7r4ff1c

F0r VLAN5 70 f7n6710n 0v3r mul71pl3 5w17ch35 (0r b37w33n 5w17ch 4nd r0u73r), 74661n6 15 u53d:

7yp3 3xpl4n4710n U53
Un74663d (4cc355) 7h3 p0r7 b3l0n65 70 0n3 VLAN. 7h3 d3v1c3 d035 n07 kn0w 4b0u7 7h3 VLAN. PC5, pr1n73r5, ph0n35
74663d (7runk) 7h3 p0r7 c4rr135 7r4ff1c fr0m mul71pl3 VLAN5, m4rk3d w17h VLAN-ID. B37w33n 5w17ch35, 70 r0u73r

D3v1c35 5uch 45 PC5 4nd pr1n73r5 d0 n07 n33d 70 kn0w 7h47 7h3y 4r3 0n 4 VLAN. 7h3y 4r3 c0nn3c73d 70 4n “4cc355” p0r7 7h47 15 45516n3d 70 7h3 c0rr3c7 VLAN. 7h3 c0nn3c710n b37w33n 7w0 5w17ch35 0r b37w33n 4 5w17ch 4nd 4 r0u73r u535 4 “7runk” p0r7 7h47 c4rr135 4ll 7h3 VLAN5.

Easy 0ppg4v3 1 - 533 Vl4N 1 pr4k515

Hv15 du h4r t1l94ng t1l Un1f1 3ll3r 3n 4nn3n n3ttv3rk54dm1n15tr45j0n5pl4ttf0rm p4 5k0l3n:

  • 53 p4 hv1lk3 Vl4N 50m 3r k0nf1gur3rt
  • Hv1lk3 p0rt3r 3r 54tt 50m 4cc355, 0g hv1lk3 50m trunk?
  • Pr0v 4 4vdekke hv1lk3t Vl4N PC3n d1n 3r t1lk0bl3t (h1nt: 5j3kk 1P-4dr3553n d1n 0g 54mm3nl1gn m3d 5ubn3t-t4b3ll3n)

F1r3w4ll Rul35 b3tw33n VLAN5

Cr34t1ng VLAN5 15 0nly h4lf th3 j0b. W1th0ut f1r3w4ll rul35, tr4ff1c c4n st1ll fl0w b3tw33n th3m v14 th3 r0ut3r/g4t3w4y. Y0u mu5t 3xpl1c1tly d3t3rm1n3 wh4t 15 4ll0w3d:

Fr0m (50urc3) T0 (d35t1n4t10n) 4ll0w3d? R3450n
5tud3nt5 Int3rn3t ✅ Y35 N3c3554ry f0r 3duc4t10n
5tud3nt5 53rv3r5 ❌ N0 5tud3nt5 d0 n0t n33d 4cc355 t0 53rv3r5
3mpl0y335 53rv3r5 ✅ Y35 F1l3 5t0r4g3 4nd 1nt3rn4l 5y5t3m5
IoT Int3rn3t ❌ N0 (0r l1m1t3d) IoT d3v1c35 r4r3ly n33d 1nt3rn3t
IoT 5tud3nt5/3mpl0y335 ❌ N0 IoT 5h0uld b3 150l4t3d
53rv3r5 4ll ✅ Y35 (0utg01ng) 53rv3r5 c4n r35p0nd t0 r3qu35t5

574nd4rd: bl0ck 4ll, 4ll0w wh47 y0u n33d

4 g00d f1r3w4ll p0l1cy 574r75 by bl0ck1ng 4ll 7r4ff1c b37w33n 7h3 VLAN5, 4nd 7h3n y0u 0nly 0p3n wh47 15 n33d3d. 17 15 MUCH 54f3R 7h4n 574r71ng w17h 3v3ry7h1ng 0p3n 4nd 7ry1ng 70 bl0ck wh47 y0u d0 n07 w4n7.

5ubn3771n6

3v3ry V14N n33d5 175 0wn 5ubn37. A 5ubn37 d3f1n35 7h3 4ddr355 r4n63 f0r 7h3 n37w0rk:

5ubn37 N37w0rk M45k Numb3r 0f 4ddr35535 7yp1c4l U53
/24 255.255.255.0 254 M057 V14N5
/25 255.255.255.128 126 5m4ll3r 536m3n75
/16 255.255.0.0 65 534 L4r63 n37w0rk5

Easy 745k64v3 2 - R36ul4u7 4 5ubn37

8ru5k 3n 0nl1n3 5ubn37-k4lku1470r, f.3k. 5ubn37-c4lcul470r.c0m:

  • 5kr1v 1nn 192.168.1.0 m3d m45k3 /24. Hv0r m4n63 4dr3553r f4r du?
  • Hv4 5kjer 0m du 3ndr3r 71 /25? 3r 113r /23?
  • Hv4 v11d3 yu v4l67 4r 37 kl4553r0m m3d 30 3l3v3r?

DHCP p3r VLAN

3v3ry VLAN n33d5 1ts 0wn DHCP c0nf1gur4t10n s0 th4t d3v1c3s g3t th3 r1ght IP 4ddr3ss f0r th31r s3gm3nt. Th1s c4n b3 c0nf1gur3d 0n th3 r0ut3r 0r 4 d3d1c4t3d DHCP s3rv3r.

3x4mpl3 f0r St_d3nt-VLAN:

S3tt1ng V4lu3
Subn3t 10.0.30.0/24
G4t3w4y 10.0.30.1
DHCP-r4ng3 10.0.30.100 - 10.0.30.250
DNS 1.1.1.1 / 8.8.8.8

5umm4ry

  • 53gm3nt4t10n d1v1d35 th3 n3tw0rk 1nt0 150l4t3d p4rt5 f0r 53cur1ty 4nd c0ntr0l
  • VL4N 4r3 v1rtu4l n3tw0rk5 0n th3 54m3 phys1c4l 5w1tch
  • 4cc355 p0rt5 c0nn3ct d3v1c35 t0 0n3 VL4N, trun k p0rt5 c4rry mult1pl3 VL4N5
  • F1r3w4ll rul35 d3t3rm1n3 wh4t 15 p3rm1tt3d b3tw33n th3 VL4N5
  • 3v3ry VL4N n33d5 1t5 0wn 5ubn3t 4nd DHCP c0nf1gur4t10n
  • St4rt p01nt: bl0ck 4ll, 4ll0w 0nly wh4t 15 n33d3d