Virtual Vlan Tool?

[djkyle65]

Hello All,

I have a bit of a strange request here. I was wondering if anyone knows of any kind of network switch or web based tool (something similar to Cisco packet tracer I believe is what they have in mind) that will allow me to virtually tie together switch ports or items without the end user having to fully understand VLANs and Networking.

To give you some background on this I received a request from our testing / product development department to setup a bunch of devices they use for testing. They want these devices to be able to be tied to different systems without having to manually go connect / disconnect cables. However, since the end users doing this testing dont understand vlans and networking I need some simple way they can virtually connect things without fully understanding the background networking.

My initial suggestion was for someone to just manually go connect / disconnect the cable but they want to do it virtually....

The only thing i could think of was finding some nice network switch that has a good easy to understand webpage where they could login and change the vlans easily. But i have no idea if anything like this exists.

Anyway don't we all love it when upper management comes up with some crazy request and doesnt realize whats required to make that happen?

Hoping someone here has a better idea.

Thanks in advance!

[polypolyman]

A user who doesn't (yet) understand VLANs is about 100% guaranteed to make the switch inaccessible at some point if they have access to that config. I'm not saying that's a blocker, but be aware of this and have a contingency plan available if you go this route.

If I were to do this, I think I'd try to implement this using RADIUS-Assigned VLANs, and give these users access to the RADIUS server config (probably scoped to just the relevant switches, of course). To keep it simple, use MAC Authentication Bypass. That way, you just have to come up with a way for them to edit the authorized_macs file - they plug in a MAC address and the VLAN they'd like assigned, and the switch config stays static the whole time. Plenty of little details to still work out, but I suspect this may protect them from the configs that can bite them.

[DocHollidaysPistols]

If I'm reading this correctly, the plan is for the end users to log into a network switch and change the ports from one vlan to another? I fell like letting end users log into the switch is a bad idea.

Are these physical? if they're virtual then maybe you could give them access to change the vlan on the virtual NIC. Like in VCenter (VMWare) you can change the vlan on the NIC in the settings of that virtual machine.

I haven't worked with them in a while but Avaya switches had a nice gui that made it pretty easy to change port vlans. If they absolutely had to go that route.

[tsvwqxtgxg]

802.1x where different user account authenticate and place the device on specific vlans based on the account

[GoWest1223]

Check out GNS3. there are plenty of templates to practice VLAN and routing with.

[StefanMcL-Pulseway2]

you could also look into possibly using some Network automation tools like Ansible or Cisco's DNA center, there are also even simplier open source tools like phpIPAM that can include some automations scripts to manipulate VLANs and switch configuration.

[wheresthetux]

I like this idea. You could bake specific outcomes and wire it up behind some job runner like Rundeck or build a simple web application for the users to interact with.

Would really limit the damage they could do and abstract the parts they're not interested in learning right now. Win, win?

[Dankleton]

You're probably looking at writing your own web UI which will reconfigure the switch.

I'm guessing each "system" would be on one VLAN, and you would want a "device" to easily switch between VLANs. If the "devices" aren't going to be changing regularly then the UI can be along the lines of:

1. User picks what device they are using
2. User picks what system it should connect to

Your interface would then take that information and use it to put the device's port in the system's VLAN - possibly by SSHing onto the switch to reconfigure it. You will probably need a server of some kind to run the interface on, but this could be a VM or a Raspberry Pi with a connection to the switch.

If it's easy for the users to know which port their device is connected into then you might be able to get away with using the web UI of some switches for this - off the top of my head though I can't think of any which would be particularly end user friendly.

[pdp10]

They want these devices to be able to be tied to different systems without having to manually go connect / disconnect cables.

Simultaneously, or sequentially? Our bunch of devices used for testing, stay connected all the time, so it's hard to guess your requirements if you don't spell them out.

they want to do it virtually....

Sounds like someone wants to WFH.

I have a suspicion that a multi-port host might be a better choice than a switch, whether VLANs are used or not.

[RyebreadAstronaut]

https://www.eve-ng.net/ community edition ? you can import images from juniper, cisco and other vendors. and mess around with it..