VLAN confusion
-
In Powershell I think it would look something like this.
Set-NetIPAddress -PrefixLength 22Of course you'd need wrap it in a foreach script that goes over the list of your servers. I'll work on it a bit later today and see what I can come up with.
-
@scottalanmiller said in VLAN confusion:
@dave247 said in VLAN confusion:
What if that range hypothetically got filled up? Would that be too much traffic?
Networks (subnets in the 1990s terminology) aren't affected by traffic. That's not a thing. If you had "too much traffic" you'd be impacted with VLANs before you were impacted without them because VLANs add extra overhead and bottlenecks. You never segment switched networks due to traffic load, that was a bus-based networking problem when all traffic traveled on a single bus for the entire network. If the bus filled up, the network would slow down.
The thing you are worried about here is saturating your switch backplane, if you do that, VLANs will hurt, not help. And you need bigger, faster switches. It's not related to your address schema.
Ok, I hear you Scott. You make sense and I'm on-board with this thinking. I think I would be up for increasing our IP range at my company to facilitate more addresses.
On another related subject: my company is in the process of finding another phone system (I actually talked with you on the phone about this, remember?). My CIO wants to go with a Cisco VoIP system and we are going through a IT business management/consultant company for this, as they are re-sellers and are going to do the install for/with us. They've mentioned setting up a VLAN for the phone system and setting up a voice router for it. Also, my CIO is adamant about keeping the voice traffic segregated for "security reasons" as it will satisfy an item on one of our various IT audits (we are a financial institution that has a lot of audits).
How can I convince my boss and Cisco that we can keep the the phones and the computers/servers on the same network and VLAN? I may end up just having to follow orders and let my company "waste" a lot of money on this stuff, but I would be willing to make the case for a smarter setup.
-
@dave247 said in VLAN confusion:
@My CIO wants to go with a Cisco VoIP system and we are going through a IT business management/consultant company for this, as they are re-sellers and are going to do the install for/with us.
No matter what your CIO misues, don't repeat false terms. It's not an IT company, it's not a consultant, it's a reseller. Never use any other term. A salesman is a salesman. He's a Cisco salesman, that's all he is. He's not on your team, he's not a consultant, he's not looking out for your interest. He's the enemy your CIO is paid to protect the company against. He's the seller's agent.
-
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
-
@coliver said in VLAN confusion:
In Powershell I think it would look something like this.
Set-NetIPAddress -PrefixLength 22Of course you'd need wrap it in a foreach script that goes over the list of your servers. I'll work on it a bit later today and see what I can come up with.
oh nice.. I haven't done a lot of scripting yet but I've been meaning to learn powershell. I did a bit back in college and a few times at my current job but I really should get cracking on it. I know scripting is essential as a sysadmin...
-
@dave247 said in VLAN confusion:
They've mentioned setting up a VLAN for the phone system and setting up a voice router for it.
Of course he has, your CIO decided on this path when he brought in a Cisco networking salesman to screw the company. That decision was made ahead of time. Cisco uses their phones as a leader to get companies to buy inappropriate networking equipment. This is a completely "by the book" unscrupulous sales tactic for VoIP sales people.
-
@coliver said in VLAN confusion:
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
Yes, I am aware of this sigh but I can only do so much. I don't want to get into the details of my work dynamic with my boss and all that, and long story-short, I have to do what he says as I am the only sysadmin/low man on the totem pole.
-
@dave247 said in VLAN confusion:
Also, my CIO is adamant about keeping the voice traffic segregated for "security reasons" as it will satisfy an item on one of our various IT audits (we are a financial institution that has a lot of audits).
That's fine IF he can prove that the audit is legit (normally they are fake) and find some regulation that the auditor is following. I'm not aware of any here, so he's need to produce this. This sounds like collusion to me. If this was an actual security concern, VLANs aren't an option, you have to encrypt the voice traffic. If someone is suggesting a VLAN to meet this audit requirement, something inappropriate is going on. No regulation makes you put in VLANs.
-
@dave247 said in VLAN confusion:
How can I convince my boss and Cisco that we can keep the the phones and the computers/servers on the same network and VLAN?
You don't. Neither of them care about what is good for the company. These are your enemies. You don't convince the enemy to stop attacking you. You get your forces to barricade your castle to keep it safe. You don't let the enemies in and then ask them not to sack and pillage once inside.
-
@dave247 said in VLAN confusion:
.... (we are a financial institution that has a lot of audits).
Go to the CEO and express concerns about the security of the department as it appears that your CIO is in collusion with a company looking to take advantage of you. If this was a Wall St. firm, you'd be legally required to do this under SEC regulations. As you are not SEC covered but just a "bank" I assume, this is just an ethical thing, not a legal one.
-
@scottalanmiller said in VLAN confusion:
@dave247 said in VLAN confusion:
Also, my CIO is adamant about keeping the voice traffic segregated for "security reasons" as it will satisfy an item on one of our various IT audits (we are a financial institution that has a lot of audits).
That's fine IF he can prove that the audit is legit (normally they are fake) and find some regulation that the auditor is following. I'm not aware of any here, so he's need to produce this. This sounds like collusion to me. If this was an actual security concern, VLANs aren't an option, you have to encrypt the voice traffic. If someone is suggesting a VLAN to meet this audit requirement, something inappropriate is going on. No regulation makes you put in VLANs.
Good point. I will ask for the specific audit request on this and find out more.
-
@dave247 said in VLAN confusion:
I may end up just having to follow orders and let my company "waste" a lot of money on this stuff, but I would be willing to make the case for a smarter setup.
Is management aware that the CIO is selling out the company and claims a security requirement but then is bypassing it to shuffle money to someone?
You have a pretty clear sign that money is going to exchange hands based on some pretty unscrupulous foundations from your description.
-
@dave247 said in VLAN confusion:
@coliver said in VLAN confusion:
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
Yes, I am aware of this sigh but I can only do so much. I don't want to get into the details of my work dynamic with my boss and all that, and long story-short, I have to do what he says as I am the only sysadmin/low man on the totem pole.
Then you're done. The company has made a decision and it's your job to implement and support it. Not your monkey not your circus as far as the purchasing decisions go.
-
@coliver said in VLAN confusion:
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
Yes, he has failed at adulting or, far more likely being that he has made it to CIO level, at ethics. The most likely scenario is that there are direct kickbacks going on.
-
@dave247 said in VLAN confusion:
@coliver said in VLAN confusion:
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
Yes, I am aware of this sigh but I can only do so much. I don't want to get into the details of my work dynamic with my boss and all that, and long story-short, I have to do what he says as I am the only sysadmin/low man on the totem pole.
In a healthy company, that statement should get you in trouble - because knowing that you have a security / ethics breach and a rogue actor putting the company at risk should be something that the company doesn't just allow you to expose, but requires you to expose. Does the CEO really not want to know that he has a CIO abusing the company for personal reasons?
-
@scottalanmiller said in VLAN confusion:
@dave247 said in VLAN confusion:
They've mentioned setting up a VLAN for the phone system and setting up a voice router for it.
Of course he has, your CIO decided on this path when he brought in a Cisco networking salesman to screw the company. That decision was made ahead of time. Cisco uses their phones as a leader to get companies to buy inappropriate networking equipment. This is a completely "by the book" unscrupulous sales tactic for VoIP sales people.
Well we are probably going to go with them and I might not have much of a say... so it's going to be difficult for me to try to pressure these people to install a system in a way different than how they usually do it. Is there any material I can reference to "prove" that VLAN's are not needed and that voice and data are fine on the same network? Actually, now that i think of it, our current voice and data are on the same network and we have no issues.
Also, regarding QoS, didn't you mention something about having the QoS set up on the VoIP RTP service rather than the voice VLAN?
-
@coliver said in VLAN confusion:
@dave247 said in VLAN confusion:
@coliver said in VLAN confusion:
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
Yes, I am aware of this sigh but I can only do so much. I don't want to get into the details of my work dynamic with my boss and all that, and long story-short, I have to do what he says as I am the only sysadmin/low man on the totem pole.
Then you're done. The company has made a decision and it's your job to implement and support it. Not your monkey not your circus as far as the purchasing decisions go.
Depends. In a healthy business of any type, anyone in IT knowing that there is something unethical going on and a breach (a rogue CIO using the company for personal gain or putting it at risk for fun is a serious breach) is in a position of "mandatory reporter." The business trusts its staff to report things like this, how else does it find out?
-
@dave247 said in VLAN confusion:
Didn't you mention something about having the QoS set up on the VoIP RTP service rather than the voice VLAN?
That is the only way to actually force the voice service to get QoS. Otherwise everything on the VLAN is getting the same high priority.
Granted there should not be much else on there, but it is not technically providing QoS to the VOICE traffic.
-
@dave247 said in VLAN confusion:
@scottalanmiller said in VLAN confusion:
@dave247 said in VLAN confusion:
They've mentioned setting up a VLAN for the phone system and setting up a voice router for it.
Of course he has, your CIO decided on this path when he brought in a Cisco networking salesman to screw the company. That decision was made ahead of time. Cisco uses their phones as a leader to get companies to buy inappropriate networking equipment. This is a completely "by the book" unscrupulous sales tactic for VoIP sales people.
Well we are probably going to go with them and I might not have much of a say... so it's going to be difficult for me to try to pressure these people to install a system in a way different than how they usually do it. Is there any material I can reference to "prove" that VLAN's are not needed and that voice and data are fine on the same network? Actually, now that i think of it, our current voice and data are on the same network and we have no issues.
Also, regarding QoS, didn't you mention something about having the QoS set up on the VoIP RTP service rather than the voice VLAN?
Things to take to your CEO (I'd honestly share this thread with him and tell him that I'm local, have an SEC background, have worked with Ray Dalio, have been in the biggest banks and hedges in the world, and will happily stop by to discuss financial ethics and rogue actors issues with him to explain the problem being perceived) would include...
https://www.smbitjournal.com/2011/07/never-get-advice-from-a-reseller-or-vendor/
https://www.smbitjournal.com/2016/06/buyers-and-sellers-agents-in-it/
https://www.smbitjournal.com/2017/07/the-social-contract-of-sales/And...
-
@scottalanmiller said in VLAN confusion:
@coliver said in VLAN confusion:
@dave247 Sounds like your company has made a decision already.
The CIO has failed at one of the most basic life skills...
"Never take advice from a sales person."
Yes, he has failed at adulting or, far more likely being that he has made it to CIO level, at ethics. The most likely scenario is that there are direct kickbacks going on.
Yes, I've heard a lot of this from you through previous posts on the S****works forums and I hear where you are coming from and get that you probably have a lot of reasons to make that assumption. People are insanely corrupt. That being said, from my impression of everyone that I work with at my company (which is a local family owned business, not a corporation) is that everyone here is pretty nice and trusting. So I think if there is any failure on the part of my CIO, its that he's not very knowledgeable with the current IT industry and he's very trusting in people. I know you might then reply with the question of why he's a CIO at all.. he is mainly involved with high level policy and procedure for several of our departments and helps ensure that we meet regulation and pass audits, and he has very good business acumen, but as I said, he's a bit behind in the world of IT these days, regarding the technical/hands-on stuff.
