Adding New Access Switches for IP Devices and CCTV with Network Isolation

Overview

The purpose of this project was to extend an existing office network to support new IP devices, including TVs, payment devices (POSE), kiosks, and IP cameras. The existing network already provided internet access for office users through the existing router, distribution switch, and access switches. However, the existing access switches were almost full, so there were not enough free ports for the new devices.

To solve this problem, two new Cisco Catalyst 2960 access switches were added: one for Floor 1 and one for Floor 2. These switches were connected to the existing distribution switch (MLS) and were used for the new devices and IP cameras.

Two separate VLANs were created for the new networks. VLAN 110 was used for devices such as TVs, payment devices, and kiosks. VLAN 120 was used for IP cameras. This separation keeps the camera network separate from the device network.

The new VLANs were added to the existing VTP system. Trunk links were configured between the MLS and the two new access switches so that both VLANs could pass through them. On the router, new sub-interfaces were created for the two VLANs. These sub-interfaces provided the default gateways and also forwarded DHCP requests to the existing DHCP server.

ACLs were then added to the router to control traffic. The ACLs prevent the new networks from communicating with each other or accessing unrelated networks, while still allowing them to reach the server-side network.

The final design provides more switch ports, network separation, controlled routing, and better isolation for the new devices.

Objectives

The main goal was to create two separate networks for the new IP devices and CCTV cameras while still allowing both networks to use the required server services.

The specific objectives were:

Add one new 24-port access switch on each floor and connect both switches to the existing distribution switch.
Create VLAN 110 for the new IP devices and VLAN 120 for IP cameras.
Use VTP to send the new VLAN information to the two access switches.
Configure trunk links between the MLS and the new access switches.
Configure access ports for the two VLANs.
Configure router sub-interfaces for VLAN 110 and VLAN 120.
Configure DHCP relay so devices can receive IP addresses from the existing DHCP server.
Use ACLs to control traffic between the new networks and other networks.
Allow the new networks to reach required server services such as DHCP, DNS, and camera storage.
Test VLANs, DHCP, server connectivity, and network isolation.

Network Architecture

Below the network topology is described.

Physical Network Topology

The physical network contains the existing server LAN, router, MLS distribution switch, and the two new access switches.

SERVER LAN

+-------------------------------------------+

| |

| +---------+ +---------+ +-----------+ |

| +---------+ +---------+ +-----------+ |

| |

+-------------------+-----------------------+

|

| 172.16.10.0/24

|

+-------+-------+

| ROUTER |

| |

| G0/0/0.110 |

| G0/0/0.120 |

| DHCP Relay |

| ACL Filtering |

+-------+-------+

|

+-------+-------+

| MLS |

| VTP Server |

| Distribution |

+---+-------+---+

| |

+-------+ +-------+

| |

+----+----+ +----+----+

| SW-1 | | SW-2 |

| Floor 1 | | Floor 2 |

+----+----+ +----+----+

| |

+-----+-----+ +-----+-----+

| | | |

VLAN 110 VLAN 120 VLAN 110 VLAN 120

Devices Cameras Devices Cameras

Logical Network Topology

The project uses two new networks:

VLAN Name Purpose Network Default Gateway

110 Devices TVs, payment devices, kiosks 192.168.110.0/24 192.168.110.1

120 Cameras IP cameras/CCTV 192.168.120.0/24 192.168.120.1

— Server LAN DHCP, DNS, storage and other services 172.16.10.0/24 172.16.10.1

Pre-configured State

Before the project, the office already had an operational router, distribution switch, access switches, and server-side services.

The existing access switches provided network access for users and other office devices. VLAN information was managed using VTP, with the MLS working as the VTP server.

The router provided routing between VLANs and also connected the network to the server-side network. The servers provided services such as DHCP and DNS.

The main problem was that the existing access switches had very few free ports for the new equipment.

Post-configured Network

After the project was completed, two new access switches were added, with one switch for each floor.

The new switches were used only for the new IP devices and cameras. Their ports were divided into two groups:

FastEthernet 0/1–0/12: VLAN 110 for devices.
FastEthernet 0/13–0/24: VLAN 120 for cameras.

The connection between each access switch and the MLS was configured as a trunk. The trunk carries both VLAN 110 and VLAN 120.

The MLS also sends these VLANs to the router. The router uses G0/0/0.110 and G0/0/0.120 as the gateways for the two networks.

DHCP relay was configured on both router sub-interfaces so that devices can get IP addresses from the existing DHCP server.

Finally, ACLs were applied to the two VLAN interfaces. These ACLs allow the new networks to reach the server-side network but block them from reaching other networks. This also prevents VLAN 110 and VLAN 120 from communicating with each other.

Technologies Used

I applied the following technologies for this project:

Cisco Catalyst 2960 access switches
Cisco MLS/distribution switch
VLANs for network separation
VTP for VLAN management
Router-on-a-stick using router sub-interfaces
Inter-VLAN routing
DHCP relay using ip helper-address
Extended IPv4 ACLs for traffic control
DHCP and DNS services on the server LAN
IP camera and storage connectivity

Configurations

Below I provided the configurations I applied on each device as real commands.

MLS Configuration

To start with, I configured the MLS first to create new VLANs as the MLS was running VTP server.

en

conf t

hostname MLS

vtp mode server

vtp domain xco

vtp password 123

vtp version 2

vlan 110

name Devices

vlan 120

name Cameras

exit

! Conencted to the router

interface gig1/0/1

switchport mode trunk

switchport trunk allowed vlan 110,120

no shutdown

exit

! Connected to the SW-1

interface gig1/0/2

switchport mode trunk

switchport trunk allowed vlan 110,120

no shutdown

exit

! Connected to the SW-2

interface gig1/0/3

switchport mode trunk

switchport trunk allowed vlan 110,120

no shutdown

exit

do write memory

SW-1

SW-1 is the new access switch for Floor 1.

en

conf t

hostname SW-1

username admin privilege 15 secret 123

line con 0

login local

exec-timeout 30 0

logging synchronous

exit

vtp mode client

vtp domain xco

vtp password 123

vtp version 2

! Connected to MLS

interface gig0/1

switchport mode trunk

switchport trunk allowed vlan 110,120

no shutdown

exit

! Access ports for Devices

interface range fast0/1-12

switchport mode access

switchport access vlan 110

switchport nonegotiate

exit

! Access Ports for Cameras

interface range fast0/13-24

switchport mode access

switchport access vlan 120

switchport nonegotiate

exit

do write memory

SW-2

en

conf t

hostname SW-2

username admin privilege 15 secret 123

line con 0

login local

exec-timeout 30 0

logging synchronous

exit

vtp mode client

vtp domain xco

vtp password 123

vtp version 2

! Connected to the MLS

interface gig0/1

switchport mode trunk

switchport trunk allowed vlan 110,120

no shutdown

exit

! Access Ports for Devices

interface range fast0/1-12

switchport mode access

switchport access vlan 110

switchport nonegotiate

exit

! Access Ports for Cameras

interface range fast0/13-24

switchport mode access

switchport access vlan 120

switchport nonegotiate

exit

do write memory

Router

The router has three main jobs:

Provide the gateway for VLAN 110
Provide the gateway for VLAN 120
Forward DHCP requests to the DHCP server

Both VLANs use the same physical router interface, but each VLAN has its own sub-interface.

en

conf t

line con 0

exec-timeout 30 0

logging synchronous

privilege level 15

exit

do write memory

interface gig0/0/0

no shutdown

exit

interface gig0/0/0.110

encapsulation dot1Q 110

ip address 192.168.110.1 255.255.255.0

ip helper-address 172.16.10.5

no shutdown

exit

interface gig0/0/0.120

encapsulation dot1Q 120

ip address 192.168.120.1 255.255.255.0

ip helper-address 172.16.10.5

no shutdown

exit

interface gig0/0/1

ip address 172.16.10.1 255.255.255.0

no shutdown

exit

ACLs were used to control traffic from the two new networks.

For VLAN 110, the policy is:

Allow DHCP traffic
Allow traffic from VLAN 110 to the server-side network
Block traffic from VLAN 110 to other networks

The same basic policy is used for VLAN 120.

ip access-list extended IsolateDevices

permit udp any eq 68 any eq 67

permit ip 192.168.110.0 0.0.0.255 172.16.10.0 0.0.0.255

deny ip 192.168.110.0 0.0.0.255 any

exit

ip access-list extended IsolateCameras

permit udp any eq 68 any eq 67

permit ip 192.168.120.0 0.0.0.255 172.16.10.0 0.0.0.255

deny ip 192.168.120.0 0.0.0.255 any

interface GigabitEthernet0/0/0.110

ip access-group IsolateDevices in

exit

interface GigabitEthernet0/0/0.120

ip access-group IsolateCameras in

exit

do write memory

Testing and Verification

To test each feature and configuration that I made, I used the commands below to verify the network. I also provide the related parts of each command's output from the simulated environment.

VTP

First, I checked that the new access switches, SW-1 and SW-2, were receiving the VLAN information from the VTP server on the MLS.

show vtp status

VTP version running : 2

VTP Domain Name : xco

VTP Operating Mode : Client

Maximum VLANs supported : 255

Number of existing VLANs : 7

This confirmed that the new access switches were running in VTP client mode, using VTP version 2 and the correct VTP domain. The switches were therefore able to receive the VLAN information from the MLS.

VLANs and Port Assignments

After checking VTP, I checked that the two new VLANs were available on the access switches and that the ports were assigned to the correct VLAN.

show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Gig0/2

110 Devices active Fa0/1, Fa0/2, Fa0/3, Fa0/4

Fa0/5, Fa0/6, Fa0/7, Fa0/8

Fa0/9, Fa0/10, Fa0/11, Fa0/12

120 Cameras active Fa0/13, Fa0/14, Fa0/15, Fa0/16

Fa0/17, Fa0/18, Fa0/19, Fa0/20

Fa0/21, Fa0/22, Fa0/23, Fa0/24

This confirmed that VLAN 110 was assigned to ports Fa0/1–Fa0/12 for the new devices, while VLAN 120 was assigned to ports Fa0/13–Fa0/24 for the IP cameras.

DHCP and Server Connectivity

To make sure that devices connected to the new access ports could receive an IP address, I connected a new device to one of the access ports and waited for it to receive an address from the DHCP server.

The device successfully received an IP address, which confirmed that the DHCP server was reachable through the router and that the DHCP relay configuration was working.

I also tested connectivity to the DNS server on the server-side network using:

ping dns.lan

Pinging 172.16.10.5 with 32 bytes of data:

Reply from 172.16.10.5: bytes=32 time=10ms TTL=127

Reply from 172.16.10.5: bytes=32 time<1ms TTL=127

Reply from 172.16.10.5: bytes=32 time=10ms TTL=127

Ping statistics for 172.16.10.5:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 10ms, Average = 5ms

The successful replies and 0% packet loss confirmed that the new network could reach the DNS server on the server-side network.

Network Isolation

Finally, I tested the isolation between VLAN 110 and VLAN 120. The purpose of this test was to make sure that devices in the two new networks could not communicate with each other while devices within the same VLAN could still communicate.

ping 192.168.110.6

Pinging 192.168.110.6 with 32 bytes of data:

Reply from 192.168.110.6: bytes=32 time=1ms TTL=128

Reply from 192.168.110.6: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.110.6:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

This showed that communication within VLAN 110 was working correctly.

I then tried to communicate from VLAN 110 to a device in VLAN 120:

ping 192.168.120.6

Pinging 192.168.120.6 with 32 bytes of data:

Reply from 192.168.110.1: Destination host unreachable.

Ping statistics for 192.168.120.6:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

All four packets were lost as expected, which confirmed that communication from VLAN 110 to VLAN 120 was blocked. This showed that the ACL configuration was successfully isolating the two new networks.

Results

The project successfully added network capacity for the new devices without using the already limited ports on the existing access switches.

Two new Cisco Catalyst 2960 access switches were added, with one switch for each floor. VLAN 110 was created for the new IP devices, while VLAN 120 was created for IP cameras.

The VLANs were distributed using VTP, and trunk links were configured between the MLS, router, and new access switches.

The router was configured with sub-interfaces for both VLANs. These sub-interfaces provided the gateways and DHCP relay functionality.

Testing showed that:

The new VLANs were available on the access switches.
Access ports were assigned correctly.
Devices could receive IP addresses.
The new networks could reach the server-side network.
The two new VLANs were isolated from each other.

Therefore, the main goals of the project were achieved. The network gained additional capacity, the new devices were separated into different VLANs, server connectivity was available, and the CCTV network was isolated from the device network.

Resources

All configuration files, project resources, and the Cisco Packet Tracer simulation file are uploaded on my GitHub for reference. Link to GitHub