Results 1 to 12 of 12
  1. #1
    Join Date
    Jun 2009
    Posts
    83

    Network configuration advice (layer 3, VLAN)

    Hi all,

    To begin with, I've spent about 3 full days reading post, after post, trying to grasp the best approach to our network.

    We are an existing company providing dedicated and shared hosting, we use 2 data centre sites in the UK, but for the purpose of this post, I'll only refer loosely to 1 deployment.

    Our network infrastructure could do with a little 'professional' attention (pm me if you are interested), whilst I'm capable and happy to learn, my practices might not always be the best/most efficient/secure.

    Our current (simplified) network is so:

    See attached 'main_network_concept.png'

    We have IP subnets routed from our DC provider to either the customers dedicated firewall or a main shared firewall.

    Each dedicated customer *without* a dedicated firewall has their own VLAN, with routing provided via "router on a stick" using the layer 2 switch and main shared firewall.

    Each dedicated customer *with* a dedicated firewall is just plugged directly into their respective firewall.

    All firewalls have an IP from our main glue/routing block and are attached to the layer 2 switch (in a dormant VLAN) together with an fast ethernet uplink to our DC provider.

    My reason for concern at the moment is that customers with a dedicated firewall *could* change their firewall IP, and that the main shared firewall is going to become a bottleneck performing routing VLAN traffic.

    My intention is to replace the layer 2 switch, with a "core" layer 3 switch - so that it can handle VLAN routing and release the burden from the main shared firewall. Like this ...

    See attached 'planned_network_concept.png'

    Some current statistics:

    As of now
    Number of VLANs: 10
    Number of dedicated servers: 13
    Average monthly throughput: 4Mbit

    Estimates for next 12 months
    Number of VLANs: 20
    Number of dedicated servers: 24
    Average monthly throughput: 25Mbit

    Budget for layer 3 swich: £1k
    Number of ports required: 1 for uplink
    1 for trunking to layer 2

    In terms of a layer 3 "core" switch, after much reading, I narrowed it down to the Cisco 3560, Foundry FESX424-PREM, HP E3500 yl the Juniper EX3200. Gigabit isn't important, as I feel our commit will always be under 100Mbit, and once it exceeds this, I'll upgrade the switches to more capable units anyway.

    The Cisco is the only one that appears to fall into my budget.

    It looks like the base IP software will be sufficient for my purposes. The number of ports isn't really important as it will be trunked off to the layer 2 switch. So these looked good to me:

    WS-C3560-12PC-S
    WS-C3560V2-24TS-S

    (Ignoring the simplified diagrams) I will be buying 2 switches and setting them up in HSRP/GLBP and connecting them to the 2 layer 2 switches. Each dedicated server has each NIC bonded (1) and connected to each layer 2 switch. *Redundancy, security and performance is key*

    What I'm ultimately asking is,

    1. Will these switches be capable for my intended use?
    VLAN routing, basic rate limiting, basic ACL, trunk to layer 2 switches

    2. Is my proposed network the most sensible approach?

    3. I recall reading a post here (goo.gl/STgjd) that mentions a situation similar to ours. They mention using RIP to have firewalls "pooled" and routed, rather than having their respective servers to be physically plugged in to firewall's LAN. Have I interpreted this correctly?

    4. Who is a capable Cisco switch admin that will implement the above.
    Attached Thumbnails Attached Thumbnails main_network_concept.png   planned_network_concept.png  
    Last edited by ben_uk; 05-18-2011 at 04:13 PM. Reason: added images links

  2. #2
    Join Date
    Jul 2008
    Location
    New Zealand
    Posts
    1,208
    We use Cisco 3560G for routing (trunking as well) and we've had no problems whatsoever with any of them. Before Cisco, we tried some HP's and another odd one, and both gave us problems.

  3. #3
    Join Date
    Nov 2010
    Posts
    190
    Quote Originally Posted by ben_uk View Post
    Budget for layer 3 swich: £1k
    ...
    The Cisco is the only one that appears to fall into my budget.
    Hm, what about HP A5120-24G EI Switch for ~670,-€ incl. VAT?
    Only has static ipv4 and ipv6 routing capabilities.

    release notes: http://bizsupport2.austin.hp.com/bc/.../c02796188.pdf

    manual: http://www.h3c.com/portal/download.do?id=1149921

  4. #4
    Join Date
    Jun 2009
    Posts
    83
    Hi Snoms,

    I did look at that switch (infact, most of the Procurve range). But what put me off this the tiny routing table.

    Routing Table: 32 entries

    The other switches above can support routing tables in excess of 5000 routes. From what I've read, the size of the routing table is important to ensure routing is done in HW rather than SW - correct me if I'm wrong

  5. #5
    Join Date
    Nov 2010
    Posts
    190
    Yes, the switch is (software based) limited to 32 static routes on its own. So, routes to 32 different subnets:

    ip route static 192.68.1.0/24 nexthop-layer3-switch-2
    ip route static 192.68.2.0/24 nexthop-layer3-switch-2
    ip route static 192.68.3.0/24 nexthop-layer3-switch-2
    ...
    ip route static 192.68.32.0/24 nexthop-layer3-switch-2

    How many subnets will you have, the switch has to deal with? If you have more, well forget that switch. If you have less within the next years... Btw, those are only few static routes, so the cpu has little to do.
    Last edited by snoms; 05-20-2011 at 12:03 PM.

  6. #6
    Join Date
    Jun 2009
    Posts
    83
    As it stands, probably less that 32 routes.

    There is 10x VLANs, each with their own subnet.
    There are 4x dedicated customer firewalls - which would need 1 inbound/1 outbound route to override default gw (I think).

    So about 18 routes to begin with. But I would safely say within a year, it will be double that - making the switch fairly useless.

  7. #7
    Join Date
    Jun 2001
    Location
    Denver, CO
    Posts
    3,301
    If you are not highly concerned with gigabit connectivity, even internally, look at Cisco 3550s. They are dirt cheap and should do what you want without much trouble. If you only need static routing, you should also consider the Juniper EX2200.
    Jay Sudowski // Handy Networks LLC // Co-Founder & CTO
    AS30475 - Level(3), HE, Telia, XO and Cogent. Noction optimized network.
    Offering Dedicated Server and Colocation Hosting from our SSAE 16 SOC 2, Type 2 Certified Data Center.
    Current specials here. Check them out.

  8. #8
    Join Date
    Jun 2009
    Posts
    83
    I looked at the 3550 - but after reading a lot of comments on here - it says they really suffer in terms of performance when using more than ~7 VLANs, and that the 3560 is recommend instead as it isn't CPU based like the 3550 range.

    That Juniper model looks good, cost-wise, its on a par with the 3560 but the feature-set looks pretty good. I've heard good things about the Juniper range too.

    Just in case I'm being particularly dim, in what instance wouldn't I be using static routes?

    My intention is to create the new network as above, which means routing specific IP subnets to their respective VLAN. Customers with dedicated firewalls need their routes changing to pass inbound/outbound through the firewall.

    Is this all achievable with static routes?

    Edit: It looks like VRRP isn't supported on the EX2200 - that's a no go then.

    I'm inclined to stretch my budget to £1,300 to get the EX3200 - ultimately, is this worth the ~£600 increase over the 3560 (am I going to see the benefits?)
    Last edited by ben_uk; 05-20-2011 at 07:54 PM. Reason: edit

  9. #9
    Join Date
    Nov 2010
    Posts
    190
    Hi,
    în my opinion, take the 3560, then. Even with IP base image it is well equipped.

  10. #10
    Join Date
    Nov 2010
    Posts
    190
    or get a used 3Com 4800G on ebay.
    (Same as HP E4800: http://h18000.www1.hp.com/products/q...a/13798_na.PDF)
    There´s currently a 24 RJ45 port going for ~700,-€
    Last edited by snoms; 05-21-2011 at 03:53 PM.

  11. #11
    Join Date
    Jun 2009
    Posts
    83
    In terms of performance, is there anything between the 12 ports 3560 and the 24 port 3560?

    I only need to trunk off to 2 L2 switches, so port quantity isn't all too important. Plus the 12 port is almost half the price (£700 new).

  12. #12
    Join Date
    Jun 2009
    Posts
    83
    Hmmm, found some EX3200s that will fall in my budget for sale here http://www.webhostingtalk.com/showthread.php?t=992501

Similar Threads

  1. Create a local network inside VLAN
    By Tomcatf14 in forum Hosting Security and Technology
    Replies: 6
    Last Post: 10-26-2010, 06:20 AM
  2. Looking for real world Layer 3 switch advice
    By SoN][c in forum Colocation and Data Centers
    Replies: 39
    Last Post: 01-27-2010, 11:46 AM
  3. Need Layer 3 switch network configuration advice
    By next-hop in forum Colocation and Data Centers
    Replies: 9
    Last Post: 02-16-2009, 01:59 PM
  4. VLAN Layer II vs Physical interconnects for new colo facility
    By WebAfrica in forum Colocation and Data Centers
    Replies: 3
    Last Post: 01-19-2007, 09:47 PM
  5. hp 2524 layer 2 switches - vlan
    By AlaskanWolf in forum Hosting Security and Technology
    Replies: 0
    Last Post: 08-21-2003, 05:01 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •