Networking new building: VLANs, subnets, wlans questions

[Utwig]

We've built new HQ adjacent to existing. Today I successfully tested 10g uplink between new core switches in both building for the first time.

The current network is a bit messy but since I don't have proper racks and patch panels in old building (everything is terminated in RJ45) and everything is in single flat subnet (it grew organically from small network of 20 devices). In new building I have proper server room with tall rack, next week we're putting in patch panels, so I will gradually move stuff over and introduce some order.

At old and new building I have Aruba 1950 48-port PoE switches

The first thing I need to do is put security cams and guests on own network. Questions:
- what do I use for DHCP for new subnet and VLAN for cams? I think using existing Windows DC for DHCP on networks which should be separate from business network is not good.
- how do I route between existing network and VLANs (what do I use for routing)? New switches are Layer3, one of existing ones probably is, endpoint 8-port switches in two offices are probably not
- For new wireless and guests I'm thinking of getting Mikrotik access points and build new wifi with two SSIDs on different VLANs, one for business, other for guests (30 PCs, 50 users, 80 devices on network). Existing wifi was done with g access points primarily for IP phones. I'll leave it in place until new wifi is online. Besides main optics WAN uplink I also have a DSL line which I used as alternate gateway before we had optics in case our primary (now replaced by optics) line went down - i'd just tell DHCP to give out different gateway. Now I plan to use this DSL line for guest network to have them completely separate from our main network.

Another question is: where do I put management interfaces for all stuff like switches, wireless access points, backup NAS, server ILO, ESX management pages? I'm thinking of management should go on it's own VLAN with no access to internet or perhaps very limited access through VPN and jump box of sorts. Since these devices will be in the 10s I'll need a DHCP of sorts for them too.

 

[Paladin]

Use Windows DHCP servers for your active directory network. If you have devices on a network that are not and will not be joined to a domain, they probably should not have network access to the Windows servers without a gateway controlling that access. That means Windows cannot provide DHCP to them easily.

I would get a capable firewall (a pair of them for failover) and make sure it can handle all the networks you need to create. Any reasonable firewall will handle being a gateway for VLANs and will connect to your switches to integrate with the VLAN setup just fine.

Yes, your WiFi should be separate from any business network. I would provide only guest WiFi in most cases. If you need WiFi for IP phones, make a VLAN and SSID for that alone, put it on the same VLAN as wired phones if needed to ease the setup of the phone services. Do not put them on the same VLAN as your important business network stuff.

A management network is a great idea and it can be a VLAN of its own. Usually you simply define all the VLANs with a security level for each, higher security is allowed to talk to things in lower security but not vice versa. Or nothing can talk to other VLANs without specific access rules, it depends on how you configure the firewall.

Most firewalls can act as a simple DHCP server or you *can* setup additional config to have your Windows servers provide DHCP via the DHCP-relay function on many managed switches. That involves exposing a bit of access to the Windows servers, but not much if you do it right. Depends on how important your security is on those servers. If you don't want to expose them at all, you can always run a separate server or servers for DHCP in all your 'unsecure' network VLANS, again using relay functions.