Segmenting a School Network After a Broadcast Storm
St Nicholas College runs a single flat IPv4 network, 192.168.10.0/24, across 24 classrooms, an admin block and a library. There are 900 students, 62 staff, 180 Chromebooks, 40 staff laptops and 55 iPads. One DHCP server hands out the whole range with a 24-hour lease. Since September, staff report that printing from the admin block sometimes fails until the printer is restarted, iPads drop off the wireless for 20-40 seconds at morning break, and the network feels slow after lunch. A consultant's capture shows 3,100 broadcast packets per minute and ARP replies for addresses that should not exist. The college has funding for one Layer-3 switch and two additional access points. Each access point draws 12.5 W and each PoE IP phone draws 6.4 W. The existing 24-port PoE switch has a 190 W power budget with 9 phones already connected. Management wants a fix before the September intake and refuses to re-cable.
1. Propose a VLAN and IP addressing plan for the college. Justify each VLAN using the evidence in the setup, and show the address-capacity arithmetic for the largest group.
Read the worked answer
Evidence first: 3,100 broadcast and ARP packets per minute on one /24 means every device processes every broadcast, and every ARP is flooded to all 24 ports plus wireless. The 'ARP replies for addresses that should not exist' points to duplicate IPs or a rogue DHCP server, not just volume, so segmentation alone will not fix it. Pair it with DHCP snooping and dynamic ARP inspection on the new Layer-3 switch.
Proposed VLANs:
- VLAN 10 Admin: staff laptops, printers, admin servers. Printers must share a broadcast domain or be routed to their clients; the printing failures fit the ARP churn.
- VLAN 20 Student: 180 Chromebooks. 180 hosts needs at least a /24 (254 usable); a /25 (126 usable) fails immediately. Use a /23 (510 usable) for intake growth.
- VLAN 30 Wireless: 55 iPads. /26 gives 62 usable, too tight with churn; use /25.
- VLAN 40 Voice: 9 phones now, room for 24; a /27 (30 usable) is adequate.
- VLAN 99 Management: switch and AP management only, with an ACL so only the admin VLAN can reach it.
Justification: five broadcast domains divide the per-VLAN broadcast rate roughly fivefold. The iPad drops are a wireless symptom, so also check roaming and re-authentication; a flooded domain delays reassociation.
The 24-hour DHCP lease is a second defect. With 900 students and device churn, a long lease exhausts the pool and produces phantom ARP entries. Cut student leases to 2-4 hours.
2. The college must power two new access points (12.5 W each) and keep 9 IP phones (6.4 W each) on the existing 24-port PoE switch with a 190 W budget. Show the arithmetic and state whether it fits, including what the figure does not tell you.
Read the worked answer
Phones: 9 x 6.4 = 57.6 W. New APs: 2 x 12.5 = 25.0 W. New load = 82.6 W. Headroom against the 190 W budget = 107.4 W, so on its face it fits.
Three things the arithmetic does not tell you:
- Existing PoE load. The 9 phones may not be the only PoE devices; existing APs are almost certainly PoE. Eight existing APs at 12.5 W is 100 W, taking the true total to 182.6 W, about 96% of budget.
- Per-port limits. A 190 W total budget does not guarantee a PoE class on any single port. 802.3af delivers 12.95 W at the device, so a 12.5 W draw plus cable loss can exceed the class.
- Cable loss and inrush. Long Cat5e runs drop voltage, and budgets are derated at high ambient temperature in an unventilated cupboard. All APs booting together draw a surge.
Judgement: keep steady-state PoE below about 80% of budget (152 W) so a port fault or a cold boot does not trip the supply. If the existing APs are on this switch, power the wireless from a second PoE switch rather than run at 96%.
3. Name two metrics you would collect before and after the change and explain what result would prove the segmentation worked.
Read the worked answer
Metric 1: broadcast and multicast packets per second per VLAN, sampled at the switch. Baseline is about 52/s (3,100 per minute) in one domain. Success is not zero; it is each VLAN at a small fraction of baseline and the student VLAN not affecting the admin VLAN. If the student VLAN is still at 50/s, the domain is smaller but the source remains.
Metric 2: wireless reassociation time and retry rate per AP, from the controller. Baseline is the 20-40 s break-time drops. Success is reassociation under about 1-2 s and a retry rate well under 10%. This matters because the iPads' symptom was wireless; a VLAN change that does not improve roaming has not solved the reported problem.
Supporting metric: DHCPDECLINE and duplicate-IP events, which should fall to near zero if snooping and shorter leases are correct. A rise means the rogue DHCP or static-IP problem was not fixed.
Do not use 'users say it feels faster' as the only measure. It was the original complaint and it is not a baseline.