kracksmith
join:2004-07-14
Fullerton, CA
| reply to TomS_
Re: running out of IP addresses
OK you are hired!
I'm going to go through what you said and explain it to my boss to see if she'll buy it.
right now we have 1 large LAN for production and 1 LAN for Accounting. they don't want to have it on one network for now. unless i can explain what you explained to me.
but within our production LAN we have many department. instead of having different logical group of subnet mask like you mention which is a security measure to avoid different department accessing other department files. but that is what NTFS permission is for right?
Within the following weeks to come, I'm planning to implement 255.255.0.0 for our production LAN so we can overcome the max 254 IP numbers.
since our production LAN is all hooked up by daisy chain style switches, i should add a router between 2 switches and control the access with ACLs for security (like you mentioned). with this router in place it will be more secure, but will this setup be faster or slower? with this all being switches broadcasting is everywhere but with a router in place information going from 1 segment to another will need to go through another layer, layer 3 instead of just staying at layer 2.
lastly if i implement 255.255.0.0 for everyone in our production LAN. technically i don't need a router right?
so the network only looks at the 1st 2 octecs but don't care for the last 2 octecs which can be anything, right? |
|
TomS_
debugger it
Premium,MVM
join:2002-07-19
Australia
| Inter-vlan performance will depend on the router you have stuck in the middle of them.
If its just a basic Cisco 2611 you wont get alot of performance, but if you say stick a 7301 (expensive!) in there with gigabit to each LAN you will get alot better performance.
As the old rule goes, you should aim to keep 80% of each users traffic local. Therefore the only traffic that should need to leave each LAN would be internet traffic, and anything else that isnt local to the LAN (for example, a network admin might initiate a Remote Desktop session to one of the accounts computers to fix something up).
Ive drawn up a quick diagram to show you exactly what ive been talking about. Each of the 3 LANs is a logical group, say for example the 3 I mentioned earlier.
»www.snnap.net/bbr/lans.png
Hope that helps  |
|
sporkme
drop the crantini and move it, sister
Premium,MVM
join:2000-07-01
Morristown, NJ
 ·Optimum Online
| reply to kracksmith
said by kracksmith  :lastly if i implement 255.255.0.0 for everyone in our production LAN. technically i don't need a router right? Remember that there is a middle ground between a /24 (255 addresses) and a /16 (65536 addresses). Have you considered a /23 (255.255.254.0) or /22 (255.255.252.0)? |
|
