New Network and VLANs

thompaine · 2016-11-03T14:40:58.000Z

Good Morning.

This might be a bit much to ask all at once, but I am starting to build my new network in my lab. I will be implementing vlans.

I have a blank vmware box with esxi 5.5 on it. I have my blank firewall that I will be running my network with. I have a new dlink L2 switch DGS-1100-24P.

I have my windows 8.1 technician PC on this network talking to my firewall.

High security is my goal, as once I have this network deployed we will be having a penetration test. Since I have 6 months to build this out there should be no excuses for documentation or any major security flaws. This is the reason for so many vlans and a management vlan and IT vlan so that I can lower the attack surface on my workstations.

I’m unsure how to start building this thing with vlans implmented from the get go. I have a fortigate firewall, which supports vlans. I don’t have any experience with esxi and vlans. I’d like to have a management vlan and an IT vlan for my network. Actually the whole list I want to user is this:

VLAN 10 – 10.0.10.x – Workstation vlan

VLAN 20 – 10.0.20.x – Server vlan

VLAN 30 – 10.0.30.x – CAD vlan

VLAN 40 – 10.0.40.x – Printer vlan

VLAN 50 – 10.0.50.x – Management vlan (routers, switches, vsphere hosts, anything else only I would ever connect to)

VLAN 60 – 10.0.60.x – 911 Vlan

VLAN 70 – 10.0.70.x – IT Vlan

VLAN 80 – 10.0.80.x – Internal WIFI

VLAN 100 – 10.0.100.x – VOIP

VLAN 150 – 10.0.150.x – Audio / Video VLAN

VLAN 160 – Public WIFI

Is this too much to ask on here? Should I open support tickets with my vendors to get going on this?

josh-elliott · 2016-11-03T14:54:52.000Z

I don’t think it’s too much to ask at all! However, in the future, I would recommend you read this Asking Better Questions .

Learning just a small amount about esxi and vlans on your own (google, search spiceworks, wikipedia, youtube, etc) will help you move forward, and when you have a specific problem (i.e. I can’t access the printer VLAN when my laptop is on the Internal WiFi vlan, here is my config… etc), thats the best time for us to help out

josh-elliott · 2016-11-03T14:56:10.000Z

So maybe the first question I would ask is: why do you have 6 months to prepare for a pen test?

thompaine · 2016-11-03T14:58:30.000Z

Josh Elliott:

So maybe the first question I would ask is: why do you have 6 months to prepare for a pen test?

I am moving to a new police station, and I am building an entirely new network, rather than take this mess that I inherited with me.

Our move in date in end of April, pending the construction over the winter goes okay, and I want to build a new network that is documented.

After deployment, I am required to have a pen test because I am making a major change to my network config.

systemsadministrator1446 · 2016-11-03T14:59:49.000Z

Very cool! I used to admin a FG FW and we had several VLANS as well. I can tell you that you will be adding interfaces and there will be cross-referenced rules for all VLANS, depending on which VLANs can talk to others or not.

Example:

VLAN 10 – 10.0.10.x – Workstation vlan → VLAN 20 – 10.0.20.x – Server vlan

VLAN 20 – 10.0.20.x – Server vlan → VLAN 10 – 10.0.10.x – Workstation vlan

VLAN 10 – 10.0.10.x – Workstation vlan → VLAN 30 – 10.0.30.x – CAD vlan

VLAN 30 – 10.0.30.x – CAD vlan → VLAN 10 – 10.0.10.x – Workstation vlan

And on and on. You’ll have a lot rules when you’re done. And then the tagging on your switches.

Good luck!

josh-elliott · 2016-11-03T15:19:58.000Z

Thomas Paine:

Josh Elliott:

So maybe the first question I would ask is: why do you have 6 months to prepare for a pen test?

I am moving to a new police station, and I am building an entirely new network, rather than take this mess that I inherited with me.

Our move in date in end of April, pending the construction over the winter goes okay, and I want to build a new network that is documented.

After deployment, I am required to have a pen test because I am making a major change to my network config.

If you are trying to build a network to survive a pen-test, is the test only going to target your switches and firewall? If it’s going to take a more broad approach (servers, user accounts, etc), then so do you.

thompaine · 2016-11-03T15:33:03.000Z

Josh Elliott:

Thomas Paine:

Josh Elliott:

So maybe the first question I would ask is: why do you have 6 months to prepare for a pen test?

I am moving to a new police station, and I am building an entirely new network, rather than take this mess that I inherited with me.

Our move in date in end of April, pending the construction over the winter goes okay, and I want to build a new network that is documented.

After deployment, I am required to have a pen test because I am making a major change to my network config.

If you are trying to build a network to survive a pen-test, is the test only going to target your switches and firewall? If it’s going to take a more broad approach (servers, user accounts, etc), then so do you.

No, it’s a full network test. Lets not get derailed. I was asking about vlans with esxi and server 2012. I haven’t found any good results with my google searches, and vlans are new to me. I don’t fully understand configuring them with dlink switches, fortigate firewalls, and server 2012 on esxi 5.5.

josh-elliott · 2016-11-03T16:02:16.000Z

Thomas Paine:

No, it’s a full network test. Lets not get derailed. I was asking about vlans with esxi and server 2012. I haven’t found any good results with my google searches, and vlans are new to me. I don’t fully understand configuring them with dlink switches, fortigate firewalls, and server 2012 on esxi 5.5.

It’s not derailing your post to make sure you actually need what you are asking for. If you read the link I shared you would know that.

On to the vlans. You need to start at the firewall/router level. Create the vlans and the firewall rules that ABPMR_MN mentioned. Once you’ve done that, I’d recommend taking one switch at a time and creating all of those vlans onto it (not sure if d-link switches are command line or GUI). Create a trunk port on each switch that has all vlans allowed on it, and connect that port to your firewall or main switch. Assigning VLANs to individual ports is fairly straightforward, but that usually comes last, and it’s something that will likely change from time to time. Next would be deciding which vlans will need to be given dhcp scopes on your windows 2012 server.

That should at least give you a good place to start

thompaine · 2016-11-03T16:19:37.000Z

Okay, I am creating my vlans on my firewall. Should I have my management vlan be my 10.0.10.x network? That is also the untagged network IP I guess too. Or should that network on my firewall be the untagged network and I should actually start my naming at vlan 20 with an IP of 10.0.20.x?

Gosh, I didn’t think it would be so hard to start from scratch. It seems like a chicken and egg scenario. Ha!

CharlesHTN · 2016-11-29T16:03:13.000Z

Sounds like you are doing some things similar to what I’ve been doing. What model Fortigate are you using? I ask as it sounds like you will use the Fortigate as the primary router for everything, so you’ll likely be hammering it quite a bit between the routing and firewall rules you’ll likely end up with.

Is the entire network for the Police Department, or other local government offices as well? (Not used to seeing CAD for PD, but the PD I support is pretty small.) How big will this environment be?

One suggestion (and from what you’ve posted, I think you are good here)…the Default VLAN of 1, don’t put anything on it. I made the mistake of using the default VLAN as my users VLAN. Now I’ve had another department move into the building, and tried to merge the two networks. Of course, they already had a different default VLAN, so it’s just another thing to sort out. We now have PD, Fire, Parks, Codes, Treasury, Court, City Admin, etc., all having offices in one building…fun to balance the needs of so many different groups.

I applaud you planning the Printers as their own VLAN. I made the mistake of putting each departments printers in their own VLAN, only to find people want AirPrint ability from their phones, which won’t work with printers on a different subnet than WiFi. With you having Printers on VLAN 40, and WiFi on 80, it won’t be too hard to make that work by spinning up a VM to be a Bonjour Gateway , you’ll just need to put interfaces on it for those two VLAN’s (plus perhaps the Server and/or Management VLAN).

thompaine · 2016-11-29T17:08:48.000Z

CharlesHTN:

Sounds like you are doing some things similar to what I’ve been doing. What model Fortigate are you using? I ask as it sounds like you will use the Fortigate as the primary router for everything, so you’ll likely be hammering it quite a bit between the routing and firewall rules you’ll likely end up with.

Is the entire network for the Police Department, or other local government offices as well? (Not used to seeing CAD for PD, but the PD I support is pretty small.) How big will this environment be?

One suggestion (and from what you’ve posted, I think you are good here)…the Default VLAN of 1, don’t put anything on it. I made the mistake of using the default VLAN as my users VLAN. Now I’ve had another department move into the building, and tried to merge the two networks. Of course, they already had a different default VLAN, so it’s just another thing to sort out. We now have PD, Fire, Parks, Codes, Treasury, Court, City Admin, etc., all having offices in one building…fun to balance the needs of so many different groups.

I applaud you planning the Printers as their own VLAN. I made the mistake of putting each departments printers in their own VLAN, only to find people want AirPrint ability from their phones, which won’t work with printers on a different subnet than WiFi. With you having Printers on VLAN 40, and WiFi on 80, it won’t be too hard to make that work by spinning up a VM to be a Bonjour Gateway , you’ll just need to put interfaces on it for those two VLAN’s (plus perhaps the Server and/or Management VLAN).

Hi Charles.

I have Fortigate 300C’s. I have two running in HA. I am going to be upgrading them to 400D’s in the spring since I can’t go to 5.4 firmware on the C’s. They should be able to handle all the routing and policies for everything.

I only manage the police department. Places like city hall, the airport, ontario works and other small city divisions do not fall under my scope. The fire department is it’s own entity as well. I do have a court office at the court house that I am responsible for, but that is it’s own site in my AD and set up on a different subnet. I will be re-iping it after the move.

So far, I haven’t put anything on the default vlan. I am starting to understand this more and the only thing on my default vlan is my firewall. I’ve also changed my numbering a bit from the first post. My scheme is 10.1.VLAN.X. That way when I re-ip my courthouse site, I can make is 10.2.VLAN.x. It’s time to build some consistency. Ha!

I never considered letting wifi users print, and I don’t think I will, but you made a good point on that if I am required to make that work in the future.