CSCF Infrastructure Technology Group

Although ACL's are applied to certain VLans for additional security, we start with three basic clases (security levels) of VLans for edge devices to be exposed to.

Current we have these network ranges in production ...

1. School of Computer Science Local-Area Intranet VLans

   10.0.0.0/12

   Netmask of the 10.0.0.0/8 private vlans range reserved for CS use. In general, hosts using these IP's can initiate communication with campus however are protected from non-CS hosts initiating a connection with them. Various subnet masks of this range of IPs have even tighter restrictions.

   10.0.0.0/16

   Lights-Out_management and other devices that don't necessarily have their own strong network security. They are only accessible from other hosts covered by the 10.0.0.0/16 netmask and documented CSCF admin masters.

   10.0.152.0/21

   CS Server Room Lights-Out_management. Only accessible from documented CSCF admin masters.

   10.1.0.0/16

   100Gb server room communication. Only interact with other NICs within the 10.1.0.0/16 netmask

   10.10.0.0/16

   10Gb server room communication. Only interact with other NICs within the 10.10.0.0/16 netmask

   10.15.0.0/16

   IAAS Management Interfaces and CS provided services only available within CS. Each 129.97.X.Y/S VLan may have a matching 10.15.X.Y/S VLan created.

   10.15.152.0/21

   Private Cloud Node VLan These IP's can initiate communication with campus hosts but are only accessible from other hosts covered by the 10.15.152.0/22 netmask and documented CSCF admin masters.

   10.15.167.0/24

   Providing services only to all CS VLans. These IP's can initiate communication with campus hosts but are only accessible from CS hosts.

   To alleviate the lack of 129.97.0.0/16 IP space, CSCF 's original request to IST was to reserve a 10.0.0.0/12 network range for CS as part of a recommendation to CTSC that the 10.0.0.0/8 private space be be divided into 16 ranges between the CTSC members. For the original campus deployment of private network ranges IST decided that they would only route VLans in the 172.16.0.0/12 range on the campus backbone. and that the other private VLans would not be routed across OSPF Area Borders that separated CTSC constituents. Note that IST's position on routing 10.0.0.0/8 private VLans has changed however the 10.0.0.0/12 is still (2021/01/01) reserved for CS use.

2. Main-Campus Intranet VLans

   172.19.0.0/16

   CS hosts that are limited to the Campus. Each 129.97.X.Y/S VLan may have a matching 172.19.X.Y/S created.

   172.19.15.0/24

   reserved for CSCF staff use.

   172.19.167.0/24

   Providing services only to UW main campus.

3. Internet Vlans

   Various CIDR VLans within 129.97.0.0

   CS internet facing hosts.

   129.97.15.0/24

   reserved for CSCF staff use.

   129.97.167.0/24

   Providing services to the Internet.

There is also a combined VLan view.

These tables where last updated from the authoritative IST database on Friday, October 30, 2020 at 12:07am and are sortable by clicking on the title of any column (if you have JavaScript enabled).

Note: An older manually maintained version of this data "https://cs.uwaterloo.ca/twiki/view/CF/VLANInformation" has vlan documentation that may contain better description information.