Bold title to start the conversation and help with T317177 (and https://wikitech.wikimedia.org/wiki/Wikimedia_network_guidelines#Public_IPs)

The ldap-replica servers are already fronted by LVS, which might make them good candidates to be moved from the public to the private vlan.
Unless they have special requirements, in that case it's an opportunity to complete the doc.