Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Design Question and Best Practice: vlan pools

This thread has been viewed 0 times
  • 1.  Design Question and Best Practice: vlan pools

    Posted Apr 26, 2014 05:46 AM

    Hi forum!

     

    Best practice question: 

     

    I had a design done by a third party consultant.  

     

    Wanted a completely uniform VAP configuration across the entire estate which spreads across all of Russia.  One obvious component is VLAN assigment to the VAP which relates to capacity.

     

    The corporate VAP had a bunch of VLANs on a pool (I like VLAN pools very much indeed).  Now I busily started configuring the same VLAN IDs across all controllers  and core switch (there are about 40 local controllers and a master/backup master pair), on each office regardless of size.  Now if I have 8 x /24's then its a bit over the top for an office of 5 people :)

     

    I have since discovered - I will concede by accident - that the VLAN pool name needs to be globally significant across the master/local configuration, whilst the specific VLAN IDs and the quantity of them assigned to the relevant pool is locally significant.

     

    This is, well in my mind at least, truly excellent for my needs, as it allow for example - 1 VLAN to be assigned for to POOL_A  for a small office, and well.. any other quantity to POOL_A on any other local controller.  As the pool name needs to be the same (again, I find this highly desirable) but the VLAN ID pool members does not, whilst still providing a consistent centrally managed configuration.

     

    So, if you have read down this far :) my question is - have I run into a 'configuration loophole' or is this kind of thing best practice, or acceptable practice?  Or are we talking about the 'depends' rule.

     

    I would favour an ammendment from the 3rd party consultants original design to replace the VAP VLAN ids with a pool name, which I can adapt locally.

     

    I am always intrested in feedback from my learned friends!  (not after free consultancy :) )

     

    Thanks in advance.



  • 2.  RE: Design Question and Best Practice: vlan pools
    Best Answer

    EMPLOYEE
    Posted Apr 26, 2014 06:03 AM

    Nik,

     

    Your approach is correct.  Define a VLAN Pool Name on the Master.  Assign it to different VLANs on the locals, based on your needs.

     



  • 3.  RE: Design Question and Best Practice: vlan pools

    Posted Apr 26, 2014 08:51 AM
    Thanks again for the pointers Colin