Addressing and VLANs
The canonical lab uses the VLAN structure already defined in the CHR design. The first lab activates only the segments needed for realistic validation, while preserving the wider pattern for future expansion.
Authoritative VLAN plan
| VLAN | Name | Subnet | Gateway | Use |
|---|---|---|---|---|
10 |
vlan10-mgmt |
172.20.10.0/24 |
172.20.10.1 |
Management |
20 |
vlan20-servers |
172.20.20.0/24 |
172.20.20.1 |
Windows servers |
30 |
vlan30-workstations |
172.20.30.0/24 |
172.20.30.1 |
User endpoints |
40 |
vlan40-printers |
172.20.40.0/24 |
172.20.40.1 |
Printers |
50 |
vlan50-voice |
172.20.50.0/24 |
172.20.50.1 |
Voice |
60 |
vlan60-corpwifi |
172.20.60.0/24 |
172.20.60.1 |
Corporate Wi-Fi |
70 |
vlan70-guestwifi |
172.20.70.0/24 |
172.20.70.1 |
Guest |
80 |
vlan80-dmz |
172.20.80.0/24 |
172.20.80.1 |
DMZ |
90 |
vlan90-backup |
172.20.90.0/24 |
172.20.90.1 |
Backup |
100 |
vlan100-hypervisor |
172.20.100.0/24 |
172.20.100.1 |
Hypervisors |
110 |
vlan110-build |
172.20.110.0/24 |
172.20.110.1 |
Image build |
Lab activation priority
VLAN 100for hypervisor validationVLAN 20for server workloadsVLAN 30for domain clientsVLAN 40for printer path validationVLAN 70for guest isolation checksVLAN 90for backup path validationVLAN 110only during image build operations
Windows placement rules
- Domain controllers and file servers live on
VLAN 20. - Domain-joined workstations live on
VLAN 30. - Build VMs use
VLAN 110only while being prepared. - Guest traffic must never reach domain services.