VLANs & The Partitioning of Networks

Herein shalt thou divide a network into segments and set forth thine reasons as to which traffic mayst pass. Thou requirest an address, prefix, gateway, and port from IP, subnets, and the default gateway and network protocols.

Commence with the example of VLANs, Task One, and the exercise upon firewalls. The foundational path is a plan for access, containing both that traffic expected to be permitted and that which shall be blocked. Practical alteration doth demand its own approved testing environment and a way back unto the former configuration. Without such access, employest thou this instance solely for planning; thou must not alter the net of the school. Calculation of subnets and setup of DHCP are optional choices beyond these.

For What Purpose Dost Thou Segment?

Division doth cleave the network into lesser parts. The VLAN parteth traffic upon the second layer. Yet a router or switch of the third layer may still convey ‘twixt them; it is but the firewall, or rules of access, that decrees what in truth is permitted to pass.

What is a VLAN?

A virtual local area network (Virtual Local Area Network, VLAN) divideth one physical switch into logical networks. The VLAN-ID doth declare unto which VLAN the traffic belongeth. Access betwixt VLANs must furthermore be governed.

Video: How doth a VLAN divide a physical network?

The video expoundeth how a VLAN divideth one physical network into sundry logical networks and separet the traffic betwixt them.

In this instance, each VLAN employeth its own IPv4-subnet:

Tagged vs. Untagged Traffic

That VLANs may function o’er multiple switches (or ‘twixt switch and router), employeth tagging:

A common PC is oft’ connected unto an access-port without itself marking the traffic with a VLAN-ID. A trunk may bear several permitted VLANs, not necessarily all. A trunk may also hold an untagged, so-called native VLAN. Read the true configuration of the port-profile ere thou interpretest the path of the traffic.

Task the First - To Behold VLAN in Deed

Hast thou leave to peruse the network’s arrangement within UniFi or some other instrument, then dost thou examine without altering aught:

• Observe which VLANs be configur’d so
• Which ports be set as access, and which as trunk?
• Compare the PC’s IP configuration with the subnet and port profile. The IP address alone confirmeth not its allegiance unto a VLAN.

Without administrator’s privilege: Employ the table of examples. A client hath address 10.0.30.10/24 and gateway 10.0.30.1. Whither of the example subnets doth it belong, and what manner of port wouldst thou choose for an ordinary PC? The expected answer is the student subnet and an access port in VLAN 30. This is but interpretation of the exemplar, no measurement of thine own net.

Firewall Regulations betwixt the VLANs

First declare who shall commence a connection, unto what destination and by which protocol or port doth it flow. A general label such as “staff to servers” is too coarse in nature to be configured directly. The table herein is but an exemplar policy that must be rendered specific:

Reply traffic signifieth not that the server hath leave to initiate new connections unto all. Rules for established/related and the sequence of said rules must accord with the firewall. Traffic betwixt devices within the same VLAN commonly passeth not through the firewall which doth rule routing between VLANs.

This is the desired final policy, no be it a proclamation to first enable broad blocking upon a network now in use. Retain necessary administration, DNS, and DHCP whilst a bounded test setup doth change.

Exercise: Client via Proxy, Not Direct to Application

Employ these example roles or equivalent known values from a testing environment:

The client shall gain access unto the application through the proxy, yet not directly upon the application’s port. Docker Level 3 doth display how the proxy and application are set forth and controlled. Pen down the plan in its own document:

Proxy and application dwell within the same VLAN in this example. The bond ‘twixt them is tested directly, yet it is not governed by these rules between VLANs. A successful trial through the proxy sheweth that the application was accessible via this path; a failed direct test alone proveth not that the firewall did block aright.

A Practical Trial within an Approved Environment of Testing

Employ a hitherto functioning arrangement of proxy and application. Take note of its customary state and present rules, and retain thy console or other path of governance so that the alteration may be reverted to former condition. Examine source, destination, port, direction, and the sequence of erections before thou modifiest one singular rule with defined bounds.

From the client’s vantage point, dost thou assay the name of the application through the proxy? For direct access unto the application, thou maist employ this means:

curl --fail --show-error --connect-timeout 5 --max-time 10 http://10.0.50.20:5000/status

The address is taken from the example; replace it with the application’s address within the testing realm. Upon such blocking, this client shall be denied the forging of an HTTP connection. A timeout may spring from other causes; compare thy findings against the firewall logs or rule counters when the tool doth provide them, and ensure at once that the application still answers through the proxy. Shouldst thou receive an HTTP 404 or 500 from the application port, know that the HTTP connection hath arrived, albeit curl --fail concludes in error.

Checkpoint: Planned vs. Actual Access

Do shew both trials with their source, goal, expectation, and true outcome. Declare the law and what these proofs confirm. Should aught stray from course, examine but one rule or one path of traffic at once, then repeat thy scrutiny. If thine alteration breaks needful access, revert thou to former state.

Hast thou employed naught save the example? Mark ye results as expected and declare which assays remain undone. Then is the plan in order, yet execution and actual effect are not shown forth. The reckoning of subnets and DHCP below be optional extensions following this checkpoint.

The Dividing of Networks

Re-election: Employ IP and subnets when thou shalt choose another address realm. The figures below pertain to common IPv4 subnets and doth display the count of host addresses following the network and broadcast addresses:

Task Twain - To Compute a Subnet

A voluntary exercise in reckoning: Employ the method from the IP lookup or a subnet calculator, such as subnet-calculator.com:

• Inscribe 10.0.60.0 with mask /24. How many addresses dost thou acquire?
• What befalls if thou alter to /25? Or /23?
• Which wouldst thou choose for a classroom of thirty scholars?

Verification: /24 yields 254 host addresses, /25 grants 126 and /23 bestows 510. Justify thy choice based upon all devices that require an address, including the gateway and other apparatus; the number of students is not the entirety of the address requirement.

DHCP per VLAN

Optional lookup: Clients that require automatic IP configuration necessitate a DHCP service which furnisheth the proper settings unto the subnetwork. Static addresses do not crave such aid. Network Services and Server Roles expound upon DHCP and reservation.

An example for the Student-VLAN:

Summarye

• Segmetring dighteth the networke into partes where traffic may be commanded and controlled.
• A VLAN is a virtual network upon the very same physical switche.
• An Access-port doth couple devices unto one VLAN; whilst a Trunk-port bearith many VLANs within its bosom.
• The Firewall’s rules determine what thinges are permitted to passe betweenne the VLANs.
• In this example, each VLAN hath his owne subnet; DHCP is of use when addresses shall bee assigned by automatique meanes.
• The final policy: block all unnecessary traffic, yet permit those services that have bin agreed upon.

Sources: UniFi: access rules and return traffic and access/trunk ports.