Take the 2-minute tour ×

At the moment our all computers in one big LAN, it is the intention to separate the admin and edu (it's in a school) especially for traffic and less for security. How do this best?

Network Diagram (Current)

Firewall?, VLAN?, IPCop (no two green zones)?, pfsense? ...

Should there be two scopes on the dhcp server (WIN 2008 R2), one for admin and one for edu or is one scope enough?

I would like your advice, I am a student in training with this task as a project.


share|improve this question
are you wanting to fully physically seperate the network into 2 discrete networks sharing a firewall/internet connection? or are you just looking to seperate the traffic for logging etc? –  anthonysomerset Feb 28 '11 at 15:18
A drawing would help -- upload it to flickr, yfrog, img.ur or something similar if need be :-) –  voretaq7 Feb 28 '11 at 15:30
fig at flickr => flickr.com/photos/60078899@N02/5485668813 –  Student_CVO Feb 28 '11 at 16:58
what did you use to draw this diagram, could you post a link please! –  seanl Feb 28 '11 at 18:49
@seanl - looks like it was drawn in Microsoft Visio to me... –  Mitch Miller Mar 1 '11 at 4:29

2 Answers 2

I consult to a lot of Australian private schools and their best method is using VLAN's. One for staff, one for admin and one for students.

By doing this, the schools security devices can be easily setup and maintained for students, without restriction staff or admin too much.

In schools I see 4 types of traffic. Administrators, Staff (non-teaching), Teachers and students. Currently most private schools are adding in 2 new groups, Parents and Alumni. The situation starts to become quite complex.

2 scopes in DHCP are fine, but you have alot more to setup, with switch port configuration. Agree with @voretaq7 Having 2 DHCP instances is far more effective than 2 nics in the one machine running separate subnets

First link describes a few different ways to perform a split - http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/9ae4e7dd-f73e-4cce-bdff-5913d5961c09

Second link is the actual deployment guide from microsoft for multiple subnets http://technet.microsoft.com/en-us/library/cc758865(WS.10).aspx

Another interesting note, most large private schools seem to use "Net Box Blue" as a filtering/firewall device, before a hardware firewall. http://netboxblue.com/ I hate the thing, but for smaller IT teams it works well.

Since it is a school project, I shouldn't really be answering your questions for you. LOL

share|improve this answer
fig at flickr => flickr.com/photos/60078899@N02/5485668813 –  Student_CVO Feb 28 '11 at 17:00

This is a great project to take on as a case study in network design.

I don't think anyone on here is going to give you the whole answer (defeats the purpose as a learning exercise), but here are some practical pointers:
For a school you want to make your networks as separate as possible -- You want "physical" separation (different switching infrastructures, or at least different VLANs) as well as network/logical separation (different subnets).

Going through your questionmarked-items above:

Yes. Definitely. With appropriate rulesets.
Brand is up to you, but both of the ones you've mentioned are good choices IMHO.

It's cheaper than separate switching infrastructures :-)

Should there be two scopes on the DHCP Server?
There should be two DHCP servers (because your network will be split into two different broadcast domains). You'll probably also want a DC in each network.
If you want to get technical you should probably create a sub-tree in AD to hold the "edu" stuff (users/passwords/etc.) so it's separate from the administrative stuff

share|improve this answer
You don't need two dhcp servers or a domain controller in each network. As long as your servers support vlan tagging and the switch permits a port to recieve tagged packets from multiple vlans then what you have in your diagram works. Having seperate scopes will make it easier to troubleshoot ip issues so i would keep that. You won't need a firewall between the vlan's unless there's a legitimate need to share services. Just maintain a firewall on the external connection for monitoring & traffic mgmt. –  Michael Henry Apr 21 '11 at 15:27
@Michael Henry - You can accomplish the separation with vlan tagging, but there are numerous other benefits to having a DC/DHCP box in each broadcast domain (assuming cost isn't a major obstacle) - redundancy and the ability to tighten access to the primary DC being the biggest ones. –  voretaq7 Apr 21 '11 at 15:57
Sure there's a world of things you can do, but this is a student and a school, and from my experience everything has to be done on the cheap unless there's a justifiable 'educational' need. By primary DC what you mean is isolating student workstations from the admin groups DC. The trouble is with a completely isolated domain you now have to double up on all your administration. Profiles, patches & policies. No windows admin (teacher or pro) is going to want to work in that environment. Accept the risk, limit the services on the DC with windows firewall and patch regularly. –  Michael Henry Apr 22 '11 at 13:43
The idea of having 2 VLAN interfaces on one server just for DHCP traffic is a crude one. Usually, you would implement a DHCP/BOOTP-relay on your routers to forward DHCP traffic to predefined DHCP Servers. If you are aiming for separation and use 2 different domains, maybe even with different admins, using 2 DHCP servers (one for each domain and the networks "belonging" to it) would be a good idea. –  the-wabbit May 13 '11 at 10:44

Your Answer


