Changed netmask to /20 and now no internet
-
Hello,
I changed the netmask from 24 to 20 so this gives me range from 192.168.0.0 to 192.168.15.254. My DHCP lease is 192.168.1.120 to 192.168.1.250 and anything outside of that (ie:192.168.1.1 to 192.168.1.119) is static IP. If I assign a computer with static IP of 192.168.3.9, subnet mask: 255.255.240.0, gateway: 192.168.1.1. I cannot access the internet, I am able to ping other systems like my desktop for example (192.168.1.10), but I cannot ping 192.168.3.9 from my desktop. What am I doing wrong?any help will be greatly appreciated.
Thank you
-
IMO, a broadcast domain with over 4k hosts is doing it wrong. Aside from that, did you make sure it was changed everywhere- LAN interface, AON rules, etc? You need to have the same netmask on all the thousands of devices you have on your network- the firewall, all the hosts… You do have thousands of devices, right?
-
Well not really thousands… but hitting close to 800 right now... about 200 computers and adding another 100 in a next couple of months, and rest are bunch of different networked devices, like data loggers, IP phones etc.
I would be OK with /22 but i think I would run into same issues as /20.Yes the netmask is updated everywhere
-
You have to change the netmask on all of the devices too.
Either a release/renew, reboot, reconfiguration of static, etc.
As an aside, I agree that some segmentation is probably in order.
-
like VLANs?
-
like data loggers, IP phones etc.
In larger networks, IP phones are generally put on a separate VLAN. In addition to reducing the broadcasts on the main network, it also allows for giving priority to VoIP traffic.
-
-
Is it possible to perform administrative tasks on separate VLANs from one computer? for example, VLAN 101 = Computers, 102 = data loggers, VLAN 103 = IP phones. If i wanted to manage data loggers or IP phones, would I need to make my computer part of that VLAN in order to access them?
-
like VLANs?
Separate broadcast domains.
If you choose to use VLANs that would work.
Just to clarify, with VLANs, the traffic is still on the wire, but not bothering as many devices.
The problem with broadcasts is that all devices have to receive and process them, whether they're interested or not. Broadcasts are used for a lot of things, including ARP, initial DHCP requests, Windows networking and more. The trend is to use multicasts, which target selected groups of devices, so others don't have to handle them. On IPv6, there are no broadcasts, only multicasts and most multicasts only go to the desired groups, down to a single device. The closest thing to a broadcast on IPv6 is the all hosts multicast and those are used only for things like router advertisements that have to go to all devices.
With VLANs, the traffic is split into logically separate networks, for example the VoIP phones I mentioned in another message. It could also be split according to departments or function, for added security. Whatever the reason, VLANs reduce the size of "broadcast domains" and the amount of processing wasted on handling unwanted broadcasts.
Bottom line, it is possible to have a network with a large number of devices on it, but that means every device has to handle all those broadcasts, rather than just a portion of them.
-
Is it possible to perform administrative tasks on separate VLANs from one computer? for example, VLAN 101 = Computers, 102 = data loggers, VLAN 103 = IP phones. If i wanted to manage data loggers or IP phones, would I need to make my computer part of that VLAN in order to access them?
Yes, while it's possible to have multiple VLANs on a single computer, the VLANs can normally be reached through a router, just as though they were separate networks.
-
JKnott - I have to say I was waiting for you to say you could just run all the same vlans on the same dumb switch.. I am very happy with your last response ;)
To the OP.. Why are you wanting to use a /20? As already mentioned you should be looking to segment your different devices.. not put them all on the same network..
What you should do is sit down and think about the different sorts of devices on your network.. Printers, servers, clients be it desktops, wireless tablets phones, etc. etc.. And then put the different devices/users you want to be able to isolate from each other on their own vlans… Then using pfsense you can easy firewall between these vlans.
If you give us some details we can help you try org your network better.. Vs you just growing larger and larger flat network.. What happens when you get over 4k devices.. Do you then move to a /19?
-
JKnott - I have to say I was waiting for you to say you could just run all the same vlans on the same dumb switch.
You still can on a small network, but there's no way I'd recommend it for a large one. In my own network, my original intent was to have a guest WiFi, with it's own SSID/VLAN. However, as discussed elsewhere, my TP-Link AP wasn't up to the task. In this situation, a performance hit caused by a lot of broadcasts was not a concern, only separating the guest network from the regular one and it wasn't worth buying a managed switch just for that task.
-
If you give us some details we can help you try org your network better.. Vs you just growing larger and larger flat network.. What happens when you get over 4k devices.. Do you then move to a /19?
Thank you guys!. I have sketched a network diagram as it stands today…. basically all switches are acting as dumb switches at the moment. When we started small we just kept adding switches and plugging things into open ports.
Any advice on how i should organise this would be greatly appreciated.
Please see attached.
 -
When we started small we just kept adding switches and plugging things into open ports.
A suggestion, instead of chaining switches in that manner, choose one to be the root switch and connect the other switches to it.
-
What are the make of these managed switches and what port density? Your going to need to get rid of those dumb switches unless you can leverage them all on the same network for all devices plugged into them.
What is the physical layout? Where are these switches. Do they sit in IDFs, or they all in the MDF or are they sitting under some guys desk?
And you have more dumb switches downstream.. Just caught that.. Wow sounds like a real mess… You have your phones running on the same broadcast domains as all your other users and computers.. Same as your wifi network even? you do understand all your broadcast traffic is going out over your wifi network right... And its shared bandwidth... So yeah lots of noise on your wifi for no reason.
That is part of the reason you don't just connect your wifi to a /20 ;)
-
I agree it is a cluster f#@k of things.
I have 3x Linksys SRW2048 (48 ports, I knows its old but works for me), 2x Cisco Catalyst 3750G (24 port each), 1x HP Procurve 1800-24G, 1x SMC GS24C SMRT ( I mean SMART). 3x 24 port dumb switches.
The downstream switches are used for connecting 8 computers/phones to single CAT5E/CAT6 cable which is coming from the server room.
All the managed switches are sitting in the same room mounted on couple different racks. -
If that is actually a representation of how you have those physically connected the first thing I would do is take one of the better managed switches and use it as a "core" switch and run out to each switch individually. In other words, don't daisy-chain switches since one failure takes down everything downstream of that.
In order to segment that network you will either need to:
1. Be satisfied with "geographic" segmentation with a different VLAN going to each edge switch untagged.
2. Get managed switches everywhere.
ETA: Missed JKnott's reply up there. Looks like there is agreement regarding the physical topology. :)
-
The downstream switches are used for connecting 8 computers/phones to single CAT5E/CAT6 cable which is coming from the server room.
I came across something like that recently. I was installing VoIP phones in an office. There was a PoE switch, so it should be a simple matter to unplug the cable from a computer and plug it into the phone. Yeah, right. I often found a small switch hidden somewhere connecting multiple computers to 1 PoE port, which makes it impossible to power more than 1 phone. Use of those small switches in a business environment should be discouraged, given the problems they might cause. On that job, I even came across one switch where a cable was held in place by an elastic band, because the latch tab was broken off!
-
Lets look at 1 part of this entire network, if you can help me organise this, I think I can apply the same logic to rest of the network. Please see the picture attached,
There is 1 CAT5e cable in the room that is coming from the secondary switch PORT#1 , it terminates into a switch in the room in Port#2, rest of the ports on the switch in the room are connected to IP phones, Desktop computers, and photocopier/printer/scanner. All Desktops and Printer/scanner needs access to File Server and the VMs. IP phones only need to access the PBX VM.How would you organise this network? Also which of the switches do you think should be the "CORE" switch? I also have Extreme Networks C5K175-24, which I forgot to mention above, its just sitting around.
Thank you
 -
Also which of the switches do you think should be the "CORE" switch?
That would depend on the switches you have. I don't know how they compare, but generally you'd put the one with the best performance, e.g. 1 Gb vs 100 Mb as core. You mentioned dumb switches, those would probably be best for connecting computers, etc. to. Are some PoE? Use them for phones. VLANs will require managed switches. These are the sorts of things to consider. Regardless, ensure you set it up in a tree structure, with a "root" switch and other switches as branches. Also, make sure you don't create loops, unless you're certain all the switches support spanning tree.
