mrroboito wrote: » Long winded explanation followed by long winded question alert. Hi, I'm looking after the network in a primary school, I'm a teacher with a little networking knowledge and I'm in the process of getting someone to take over looking after our network but haven't got anyone yet. In the meantime I'm running out of IP addresses and regularly have to bump phones off the network in order to get teacher's laptops back on (I plan to set reservations for teacher laptops so that this won't continue but I'm still short of addresses). I have two choices, one is to get the "school broadband" people to increase the number of ip addresses available to the school (all public IPs), the other choice is to configure DHCP on a private ip range on Windows server and then connect (bridge?) to the public address on the "school broadband" Cisco router to get internet access. I think the second solution is better as it gives us more control over the network because, for example, I won't come up against this problem again if we get more devices in the school by having, for example, a BYOD day. I can set up DHCP on the server (I have an internal scope set up but deactivated for the time being) but the trouble is I'm not sure of the best way to ensure internet access. I have Win server 2012 OS on a PC with one NIC, the aforementioned Cisco box is on the same subnet and acts as our gateway. Now for the long winded question(s): Do I need another box between the server and the Cisco? Or Can I reconfigure the Cisco to acknowledge the internal subnet? Or Do I need another NIC in the server? Or Can this all be done through the server? (If it's done through the server will all internet traffic go through the server creating a bottleneck or will the client and Cisco router communicate directly?) Or Am I talking through my arse and there's a very simple alternative that I haven't mentioned? I'd appreciate a push in the right direction. Thanks, Rob
mrroboito wrote: » I'm looking after the network in a primary school, I'm a teacher with a little networking knowledge and I'm in the process of getting someone to take over looking after our network but haven't got anyone yet.
mrroboito wrote: » I have Win server 2012 OS on a PC with one NIC,
gctest50 wrote: » It might be better if you look after it - you'll always be on-hand to fix tiny issues before they become a problem and ( free bonus! ) you should get good at it - might lose the will to live though Is this PC doing any other jobs at the moment ?
DublinDilbert wrote: » You need to plan out your network before making any changes. Sounds like you have proper external IP addresses, how many have you got? How many fixed hosts have you on the network? Do you want the byod devices to be able to access the network resources or just the internet? How many wireless devices do you need to support? What sort of wiresless access points have you got? Sounds like a bit of a free for all on the wireless at the moment. Your going to have to look at nat-ing, to support all the different hosts. I'd be surprised if you had a block of external IP addresses, I'm guessing your dhcp pool might be getting depleted, but that's a guess.
mrroboito wrote: » Loads of questions there, to be honest, the network is set up pretty well, I have approx 20 fixed ips on APs, printers, NAS, etc. We have enterprise level Motorola wireless set up with three VPNs, most mobile devices just need web access, we might have 120 wireless devices in use daily plus guests. The problem is I have only 120 public (genuinely) ip addresses to handle all this. I can handle most tasks and config, I just don't know what is best practice for getting web access for my clients when I change to private IPs.
DublinDilbert wrote: » Are the fixed ip addresses you've assigned to the printers, nas, etc internal IP addresses? Or have you selected 20 of the external ones but have them statically assigned to these devices? It's not clear if your using internal IP addresses on the lan and nat-Ing onto the real address when going external???
mrroboito wrote: » Hi, Everything in the building is on the external/public addresses.
mrroboito wrote: » I think the second solution is better as it gives us more control over the network because, for example, I won't come up against this problem again if we get more devices in the school by having, for example, a BYOD day. I can set up DHCP on the server (I have an internal scope set up but deactivated for the time being) but the trouble is I'm not sure of the best way to ensure internet access. I have Win server 2012 OS on a PC with one NIC, the aforementioned Cisco box is on the same subnet and acts as our gateway.
rogue-entity wrote: » You confirmed that the Cisco router is issuing public IPs to connected devices, that you have 120 of them (so you have a /25 subnet) not counting devices with static addresses assigned. If these are not firewalled then you have infrastructure (and guest devices) exposed directly to the Internet. The simplest approach would be to have a large flat network, but the ideal approach would be to use a number of subnets to make things manageable. Both of these require that you obtain or build a router/firewall that can act as your gateway between the internal private network and the external network. Each subnet could then have it's own public IP and separate firewall rules over what is permitted in and out of the network. Even different priorities for example if you have VoIP telephone service. Take the above as a suggestion, others may have a better approach.
Shishkebaby wrote: » ... Also what Model is the Cisco Router ?
davo2001 wrote: » Any particular reason for this? Would it not be easier to have everything coming in on one external IP and router it to a private subnet?
ED E wrote: » It appears to be HEANET doctrine. Im not sure why. Some of the large 3rd levels still give EVERY machine a public while others moved to NAT.
