Networks

Ask something
Discussion Locked

Network redesigning problem....

0 helpful
19 replies

by abubin

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My LAN currently is setup with subnet 192.168.1.x/24. I have a linux server serving internet service also in same subnet. There is 2 windows 2000 server running the domain and DNS services.

All clients connect to domain with this credentials assigned by DHCP server from both the windows2000 server.

ip : 192.168.1.x
subnet : 255.255.255.0
dns 1 : 192.168.1.2
dns 2 : 192.168.1.3
gateway : 192.168.1.4 (linux server)

So for, no problem. But now, I want to add another subnet to the system. Perhaps 192.168.2.x. But I am not sure how to do this.

I was thinking of adding another NIC to the linux server and it will act as a router to connect the 2 subnet. But then, what about the win2k servers and the DNS servers? If I continue using the win2k servers like this, how does the new subnet login to the domain? Do I absolutely need to have another set of domain servers?

19 replies

by bfilmfan

You add the sunet to the Active Directory Sites and Services and associate it with your AD site. You do not need a new set of domain controllers.

by cg it

Typically subnetting is done by a router or a VLAN capable switch.

A Windows Active Directory Environment can handle a large # of users spread over a large geographical area by the use of sites. Windows AD defines a site as a subnet connected by fast links. Creating sites and associating a subnet to a site is done in Active Directroy Sites and services. A DC or GC along with operational master roles do not need to be installed in a site if the site has a small number of users or a small # of users and not servers in the site. If you create your site in AD sites and services and associate that site to a subnet, users on that subnet can access the Global Catalog at another site for log in. All that is needed is a WAN link [typically complished by a router].

by cg it

Note: you can have 1 large site in a single domain. you can have multiple sites in a single domain and you can have multiple domains within a site [but you need multiple DCs to service the multiple domains within a site] remember a site is a subnet connected by fast links and is not a logical structure [like AD and Domains are] but a physical structure.

by cg it

What confuses a lot of people is the logical structure of Active Directory and Domains vs the physical structure [topolopy] of a network. Sites are physical structures because they are subnets connected by fast links. your second subnet can be setup as a site [if you want and if your practicing setting up sites on a test network] and using the best practice of small # of users or small number of users and no servers in a site [provided the site has reliable and fast link] you don't need a DC or GC at the site.

by wmr029

You could just change your subnet mask to 255.255.252.0 which would give you a range of addresses ranging from 192.168.0.1 to 192.168.3.254

by cg it

I put in a suggestion here and for some reason it doesn't show up. I'll try to recap.

First to answer your question do you absolutely need to have another set of domain servers? No you don't.

If you continue to user your existing W2K DNS servers, how does the new subnet login to the domain? By creating a Site in AD sites and Services, then associating that site with the subnet.

Sites are subnets connected via Fast links. A router is normally used for subnetting but you can use a VLAN as well. Sites do not have to be in different physical locations [as in a test network setup where the subnets are seperated by a router and the 2 routers that connect the subnets together happen to be within 3 ft of each other] but a site is typically thought of as a in a different physical location than other sites. Best practice is that is sites have a small # of users and a fast reliable link that has adequate bandwidth and/or small # of users and no server, then you don't need a GC at the site for user login. They can use the fast reliable WAN link that has adequate bandwidth to use a GC at another site for log in.

Hope that helps ya.

Text book stuff.

by cg it

Note: users who VPN in through RRAS are remote users and when they make a connection its as if they are directly connected to the network which is NOT the same as a site defined in Active Directory. AD sites are well connected subnets basically using dedicated lines router to router.

by abubin

I have looked into setting up sites in AD. I manage to setup another site. But without a server assigned to that site, how would login from the other subnet be able to resolve? How would the other subnet be able to find the DHCP server? Therefore, I would really need at least a DHCP server (maybe from router) to assign the IPs before they can find where is the gateway?

by cg it

welp, it goes like this, clients are configured to look for remote DNS servers over the WAN link in which to authenticate to not local DNS servers on their subnet [which there isn't any] [DNS provides the SVR and PTR records to the DC Global Catalog server]. This is done on a dedicated link NOT via the internet. If you want and are running DHCP on one subnet and want that DHCP server to issue IP addresses to computers on another subnet, add in a DHCP relay agent on the subnet you need IP addresses for. You can create different scopes of IP address in DHCP for different DNS zones in the DNS namespace. Therefore you can create a site, associate a subnet to that site, then give that site it's own DNS namespace [zone], create a scope of IP addresses in DHCP and for that zone, authorize DHCP for the zone to service clients in that site [it's own DNS namespace].

by cg it

AD, DNS etc, are logical structures not physical structures therefore your not confined to physical structure layout.

by abubin

You help has been most helpful but I am still a little bit lost as I have always been playing with only 1 subnet in AD. Like you said, I need to have a DHCP relay agent for the new subnet. Wouldn't that also means that I need either a Win2k server or a third party DHCP server for that? Which comes back to my basic question of needing a "server" or router.

Ok, perhaps I could elaborate on why i need another subnet. It's because my single subnet is having bandwidth issues. Transfering files through network is getting very slow due to too much traffic. And I only have around 50 PCs. I was hoping that creating another subnet would cut-down all the broadcasting by half. Am I right in this assumption?

Thanks in advance for the help.

by tosh74

You say you only have 50 nodes on your network. I do not think thatand extra subnet will help you out here. You have a bottleneck somewhere. You need to find out where that bottleneck is. Try running ping -t from various workstation. Also try using tracert 'server ip' from various workstations. Do all of you workstations and server connect via a switch or hub ? Hubs will forward broadcast packets through ALL ports and end up flooding your network with a broadcast storm.

HTH

by abubin

I am using Switches. No hubs here. All are unmanaged switches. I am also dumbfounded as 50 nodes in a LAN is small and 100mbit line should be sufficient. I have been looking into this problem for so long until now, I have to separate them into subnets to see if certain workstations are taking all the bandwidth. Because we do have graphics department that transfer files that are hundreds of megabytes each minute. Not to mention them sending into printing files sizes of up to 300MBs.

by snapier

Well,

1. Add an alias to your linux box NIC and edit the firewall rules to allow the traffic.

2. Add the new subnet scope to your DHCP servers and your DNS servers then connect your next set of workstations to the network and add machine credentials on the servers and connect to the internet.

It will be the dhcp server that gives the required information.

gateway 192.168.2.x or have the linux box advertise the route and add the router option to the dhcp server.

--SamN

by cg it

no you don't need a server on the subnet to have DHCP relay agent. DHCP discover/acknowledge/offer messages don't pass through routers so the router acts as a relay agent sending the discover/acknowledge/offer messages on to the DHCP server. Having a server on the subnet won't affect DHCP traffic through a router.

50 comps on a subnet isn't much. If you having bandwidth problems on a 50 node subnet then there's an awful lot of traffic. I would put a sniffer on the segment and try and find out whats chewing up all your bandwidth. If you've got a lot of graphics people passing large graphic files around then might look into why they are sending large files around on the network.

by cg it

you can segment them into their own subnet which would reduce total network traffic but they will still pass around large files on their subnet. That subnet might experience network congestion. [Solved one problem but theres still a problem]

by cg it

note: you might want to consider going to a managed switch.

My suggestions are based upon actually physically subnetting out some comps via a router [or a managed switch with VLAN] High traffic generating comps are on the VLAN so traffic is confined to that segment. The real question is, is it necessary for them the generate that traffic?

by k12linux

You can serve your clients accross the Linux box as you mentioned. Set up DHCP on the Windows server to handle the 2nd subnet and then run dhcrelay on the Linux box so it can act as a DHCP gateway for the new subnet.

Of course you'll have to give the correct gateway (ie: 192.168.3.4 perhaps) but that can (really should) bet set in your DHCP setup. You'll also have to ensure that ip_forwarding is enabled and if you are using iptables as a firewall on the Linux box that you have appropriate rules added to the FORWARD chain.

Start with a box that you give a static IP, subnet mask and gateway to for testing. Once that works you can try DHCP.

When all is said and done you will have access to all sorts of monitoring and logging tools on the Linux box.

This discussion is closed to new replies.