Does it make sense to separate printers, phones, computers into separate VLANs?

Question

Computer networks

There was a need to separate printers, IP phones and workstations into separate VLANs.
Would such a scheme be correct? Mikrotik has a DHCP server that distributes IP addresses to 3 subnets - 10.10.3.0 (printers), 10.10.2.0 (phones) and 10.10.1.0 (workstations). The DHCP server will distribute an IP address to all devices based on the VLAN specified on the device.
The correspondence is:
10.10.3.0 - VLAN 30 (printers)
10.10.2.0 - VLAN 20 (phones)
10.10.1.0 - VLAN 1 or no VLAN ? (workstations)
Is this VLAN usage correct?
As well as:
1. How to make workstations see network printers? The printers will be in a different VLAN. Will it then be necessary to use a print server that will simultaneously "look" in VLAN 30 and VLAN 1?
2. I would like that only I could access the web-face of phones and network printers from my machine. It turns out that my machine should be in all VLANs at the same time? How is this done if I have Windows?
Thanks in advance.

Answer 1

Rules of good manners, they say what is necessary. The diagram is correct.
1. This is done by setting up routing between Vlans on the router or L3 switch.
2. No. You simply open on the desired port access to those Vlans where you want to go.
We read - Networks for the smallest . And from chapter zero.

Answer 2

A separate VLAN for printers is an extra hassle for yourself. You will first drive them into a separate VLAN (it is not clear why), and then you will look for an opportunity to bypass the VLAN restrictions. "The efficiency of these two actions is 0" :-)
For phones, a separate VLAN is quite justified.
If you really want to breed VLANs, get a gateway that will sit in all VLANs and through it you can go from anywhere to the desired VLAN, after setting up routing to a slave. place.

Answer 3

The logic is correct. Vlan numbers do not matter, but it is right and good to separate devices of the same type into separate networks. Connectivity between vlans is provided in the same way as between separate physical networks - using a router. Read what VLAN trunking is, and see how it is implemented on Mikrotik, and configure routing on it.
Network segmentation is not just good manners, it is a necessity, especially in light of the development of malware / viruses and other information security threats. Printers/phones are vulnerable devices, so they need to be isolated. A flat network where all computers in an organization are in the same vlan/network segment will cause any stray NotPetya to spread throughout the network in a matter of minutes. And it will be like here. Or some mother's hackers will start picking the computers of the neighboring department over the network. So segmentation and configured rules for traffic between subnets are a must have in modern conditions.

Answer 4

Phones in a separate vlan, printers and work clamps in a vlan vlan (not separating them, it makes no sense) vlan1 - do not use it better. Admins - to a separate vlan grid and from it access to the mgmt network and to all data networks