Starting point for fiber Conversion

This is a question regarding the starting point for the following bigger picture

http://www.experts-exchange.com/Hardware/Networking_Hardware/Routers/Q_23688899.html

...where to start.  We are about to begin our migration from a T1 infrastructure to Time Warner's Metro Ethernet. 4 of our 15 sites including our main site are already on the fiber.  I would like to get the core configurations done with these site first before I start moving others.  Being a local government entity, with police and fire and EMS, I am sure you can understand that down time is a major issue.  I have attache a diagram of the initial plan but will lay out a few minor requirements and some of what I have done so far for review and critique.

We will start with 4 Sites

Site A - This is our City Hall where most of our servers are located and where our internet comes in.  We will have a Cisco 2821 Router with 2 - GigabitEthernet, 4 FastEthernet, and 1 DSU.  I and pretty sure I need to configure a trunk port on this router to connect to the Metro-E.  Here a what I have done so far for the configuration of the router.
!
interface FastEthernet0/0                                                                            <--------MGMT on Diagram
 description VLAN10 MGMT-IT
 ip address 192.168.96.1 255.255.255.0
!
interface FastEthernet0/1
 description ASA FIREWALL
 ip address 192.168.110.1 255.255.255.224
!
interface FastEthernet0/2                                                                            <--------SITE A users on Diagram
 description VLAN20 CITYHALL
 ip address 192.168.99.1 255.255.255.252
!
interface FastEthernet0/3                             <--------To existing network where site to be migrate are
 description TEMPORARY LINK TO EXISTING ROUTERS
 ip address 192.168.109.1 255.255.255.252
!
interface GigabitEthernet0/0                                                                        <--------SITE A on Diagram
 description VLAN30 SERVERS
 ip address 192.168.101.1 255.255.255.0
!
interface GigabitEthernet0/1
 description dot1q trunk port to METRO ETHERNET
 no ip address
!
interface GigabitEthernet0/1.1
 description VLAN 10 NATIVE
 encapsulation dot1q 10 native
!
interface GigabitEthernet0/1.2
 description VLAN80 UNUSED
 encapsulation dot1q 80
 ip address 192.168.98.1 255.255.255.254
!
interface GigabitEthernet0/1.3                                                                   <--------SITES B and C on Diagram
 description VLAN COURT, FIREADMIN, LIBARY, KSP, STREETS, GOLF
 encapsulation dot1q 20
 ip address 192.168.100.1 255.255.255.0
!
interface GigabitEthernet0/1.4
 description VLAN40 WATER
 encapsulation dot1q 40
 ip address 192.168.104.1 255.255.255.0
!
interface GigabitEthernet0/1.5
 description VLAN50 WASTERWATER
 encapsulation dot1q 50
 ip address 192.168.105.1 255.255.255.0
!
interface GigabitEthernet0/1.6
 description VLAN90 UNUSED
 encapsulation dot1q 90
 ip address 192.168.107.1 255.255.255.254
!
interface GigabitEthernet0/1.7
 description VLAN100 UNUSED
 encapsulation dot1q 100
 ip address 192.168.109.1 255.255.255.254
!
interface GigabitEthernet0/1.8                                                                         <--------SITE D on Diagram
 description VLAN70 KPD
 encapsulation dot1q 70
 ip address 192.168.109.1 255.255.255.254
!
interface dsu0/1
 description VLAN60 AIRPORT
 ip address 192.168.1.25 255.255.255.248
!

We want to implement VLANS for are site that require extra security (i.e. Waster Plant and Police).  Aside from the site was really want to isolate, most everyone else will be on the same VLAN.

VLAN10 (I think this is the native but not sure about that)
This is our management VLAN  Everything on this VLAN is physically located at SITE A.  out IT staff will be on this VLAN and also our back-end Virtual Server management is here.  Devices on this VLAN should be able to access anything on the entire network.  Devices on the VLAN will have static ip addresses on the 192.168.96.0 network

VLAN20
Is the primary VLAN for most of the city's regular users.  For today's purposes, the users at SITE A, All of SITE B, and all of SITE C will be on this VLAN.  There will be more sites added to this VLAN, but our hope is to have everything ready so we easily transition them over when their time comes.  Devises on the VLAN should pull DHCP from our Domain controllers using the 192.168.100.0/24 address pool.

VLAN30
All of our Servers (Physical Machines and Virtual Front-ends) are on this VLAN.  Servers should be accessible from all devices on the network.  All addresses are static on the 192.168.101.0 network.  Management will be done through the back-end through the management network (VLAN10).

VLAN70
The is our Police Department and SITE D on the diagram.  This site has  Cisco 2811 router.  The reason for the router is Police specific to resources outside our network. Not sure how to configure the access port here.  All users and department specific server are on this VLAN.  Certain users on SITE C will need access to the servers on this VLAN.

The switches at all of the site are Cisco 3560 (port count varies)  Here is a sample config for the access port on each switch.

!
interface FastEthernet0/24
 description VLAN20 traffic from fe0/2 on CHR1
 switchport mode access
 switchport access vlan 20
!
interface VLAN10
 description MGMT ACCESS
 ip address 192.168.96.50 255.255.255.0
!

Obviously the VLAN tags and descriptions will change accordingly.

Like I said before, this a live migration and all the devices on the T1 site still need to be active while the migration is underway.  That being said, I think you have enough information to answer a few starting questions.

1 - What is the Native VLAN?  Is it the VLAN provided by the ISP for the Metro-E?  Should my management Network be on the native?

2 - When we migrate the Servers and put them on their new VLAN, will the devices on the old network not yet migrated to fiber still be able to access them?  Should I move them last?

3 - I know there is 1 access port on the remote switches to connect to the Metro-E.  Do the rest of the ports on these switches need VLAN tags too?

4 - From what you have looked at so far, are we on the right track?  Are we missing something?  Is there a better way?  What are some of the best practices for what we are trying to accomplish?  Please let me know any ideas or concerns you have with my design.Start Free Trial