Flat District LAN After IP Cameras and VoIP Are Added
An e-governance office in a Rajasthan district has 60 desktop PCs, 30 new IP cameras, 20 VoIP phones and two servers, all on 192.168.10.0/24 with a single flat VLAN. The LAN uses three daisy-chained 24-port unmanaged switches; the only uplink to the router is 100 Mbps. Each camera is configured at 4 Mbps constant bit rate, and the phones use 80 kbps each plus signalling. Since the cameras were added, users report intermittent DHCP failures, phones reboot during file transfers, and the switch uplink shows 85–95% utilisation at peak. The DHCP server is on the server VLAN and the router is the only Layer-3 device. A vendor proposes simply buying a 1 Gbps switch and 'letting the cameras run'. The office must complete a security audit in three weeks, and the auditor will ask for segmentation evidence.
1. Calculate the peak load generated by cameras and phones and judge whether the proposed 1 Gbps uplink alone solves the design problem. Show assumptions.
Read the worked answer
Camera load is 30 x 4 Mbps = 120 Mbps constant bit rate. Phone load is 20 x 0.08 Mbps = 1.6 Mbps, plus perhaps 10–20% signalling, so about 2 Mbps. Even before desktop and server traffic, the camera aggregate alone exceeds the 100 Mbps uplink; at 85–95% measured utilisation the link is already saturated at peak. A 1 Gbps uplink gives ten times the raw capacity and would remove the immediate oversubscription, but it does not solve the design problem: all 112-plus devices remain in one broadcast domain, camera multicast and broadcast traffic still reach every port, voice has no priority, and there is no security boundary for the audit. There is also no redundancy in the daisy chain. The 1 Gbps switch is therefore necessary but not sufficient; it must be combined with VLAN segmentation, IGMP snooping, storm control and QoS.
2. Produce a VLAN and IPv4 addressing plan using 192.168.10.0/24, with subnets for data, voice, cameras, servers and management. Show network/broadcast, usable range and gateway for each, and state where DHCP relay must be configured.
Read the worked answer
Use the following plan. Data VLAN 10: 192.168.10.0/25, usable .1–.126, broadcast .127, gateway .1. Cameras VLAN 30: 192.168.10.128/26, usable .129–.190, broadcast .191, gateway .129; a /26 gives 62 hosts, enough for 30 cameras with growth. Voice VLAN 20: 192.168.10.192/27, usable .193–.222, broadcast .223, gateway .193; 30 hosts for 20 phones. Servers VLAN 40: 192.168.10.224/28, usable .225–.238, broadcast .239, gateway .225; 14 hosts for two servers. Management VLAN 99: 192.168.10.240/28, usable .241–.254, broadcast .255, gateway .241; 14 hosts for switch and router management. Because the DHCP server is in the server VLAN, configure DHCP relay (ip helper-address) on the Layer-3 router or switch for every client VLAN; otherwise DHCP Discover broadcasts will not cross VLAN boundaries. Keep servers and management on static addresses or reservations.
3. List the switch configuration and physical changes you would prioritise before the audit, including QoS and storm control, and explain how each addresses an observed symptom.
Read the worked answer
Replace the unmanaged switches with managed Layer-2/Layer-3 switches, create the VLANs and trunk them to the router. Enable IGMP snooping so camera multicast does not flood every access port; enable broadcast and multicast storm control on access ports; enable DHCP snooping and port security to block rogue servers and unauthorised devices. Configure QoS trust of DSCP on the voice ports and give voice a strict priority queue, because phone reboots during file transfers point to congestion and no priority. Replace the daisy chain with a star or resilient ring topology and provide a 1 Gbps fibre or copper uplink, using link aggregation where available. Move cameras to PoE switches near the cameras to avoid long daisy chains and power injectors. Add a UPS, label all ports and produce VLAN and IP documentation for the auditor. Monitor uplink utilisation, broadcast rate and DHCP lease failures for a week before the audit.