0

We're in the Philippines and having a hard time getting independent guidance on what is the best solution for us. Most consultants are tied to specific vendors or solutions.

We're looking for a router or routers (probably Cisco) that can handle anywhere between 80-140 users. We are looking for a solution that can handle DHCP, bandwidth management, content filtering, firewall, and load balancing. We're not looking at VPN capabilities at this point, but may consider it in the future.

I've checked with several Cisco partners and they proposed very different models to choose from. And after checking the models they proposed, I feel they may be overkill.

We are using two internet providers. One is 4MBPS, while the other is 1MBPS. This is the reason why the load balancing feature must be present.

Finally, several vendors have recommended a single UTM appliance to handle all our requirements. After checking on them, these look promising but then I'm not sure if this is the right route to go.

Any ideas or pointers on what we should get would be great.

Improve this question

3 Answers 3

Reset to default
2

For your Dual WAN (both internet lines) ONE Router with Dual WAN Capability, I would recommend DrayTek (Cost effective, feature rich, ease of use, great support and a good firewall too) - you can always get a zyxel / watchguard firewall in front of this but DrayTek should be good enough if configured properly.

http://www.draytek.com/user/PdInfoDetail.php?Id=113

A DrayTek 2955 or DrayTek 5300 Series
http://www.draytek.com/user/PdListbyNewCategory.php?action=LoadData&Typeid=135

--------Now for your Lan users (80-140) You can get HP Procurve 2x48 or 3x48 Port Switches or if you already have switches in place then the draytek router would be good enough.

Draytek can work in loadbalance mode so basically it will be utilizing both of your internet lines at the same time. Most importantly it supports free VPN tunnels (200 of them) without any additional cost.

Hope that helps

Watchguard does dual wan as well, but they are more costly as compared to draytek, in terms of subscription, vpn licenses etc.

Improve this answer
1

There is no single "right" way to go. It's quite possible that there are several solutions that would work for you.

One important option that you might not have considered is to use a PC running Linux (or FreeBSD/OpenBSD), if your organization has any experience in that area. One major bonus is on pricing: with this approach you would not be tied to the pricing whims of your vendor and consultant. And you could add VPN capabilities if/when you need them for no extra cost.

Basic routing/NAT is trivial, DHCP, firewalling, load balancing are all very straightforward and much instructional material and help can be found for free here and elsewhere on the net (there are plenty of consultants you can pay as well if you want more formal assistance, myself included).

Bandwidth management and content filtering are necessarily more complicated topics depending on what kind of rules you want to implement, but there are solutions available in the free software world for these problems; indeed, many of the commercial products are simply repackaged versions of the same software.

If your organisation does not have any experience with Linux or the BSDs, it might not make sense to start just for this networking project; however, there are organizations that have done exactly this with great success. Or it might even be the beginning of a new IT strategy for you. I have known several organisations that have started with networking and then moved towards open source software in other areas.

Update/upgrade can be argued as feature in either direction; it's likely that commercial products will have a simple (but comparatively expensive!) 'update everything' button, on the other hand, if they are merely repackaging free software, you might be better off with the latest release of the source.

These are many of the same factors that affect any buy vs. build, commercial vs. open source decision.

The point I'm trying to make is that a rigourous analysis that correctly determines the most cost effective solution for your needs is probably far more trouble than its worth; what you need to do is find something that will take care of your requirements at a cost (time/money/effort) that you can afford.

Improve this answer
2
  • 1
    Mostly agreed - but increasingly there are lots of hardware devices providing much of the functionality required but at a lower price than buying even a low spec PC. Add to that the cost of the skills needed to set up and run such a device - and the problems of finding a supplier to support a Linux/BSD based installation, its not always a cheaper route for very small organisations.
    – symcbean
    Jan 24, 2011 at 15:09
  • 'Much of the functionality' is probably not good enough. Anyway, if the organization can't afford a PC, there's probably something available somewhere from 15 years ago for nothing that's powerful enough. Also, I'm not sure that this counts as a 'very small' organisation. He said 80-140 users.
    – dotplus
    Jan 24, 2011 at 16:00
0

If you're using multiple upstream ISPs, you will (most probably) communicate with them using different IP ranges, at that point "load balancing" effectively boils down to "give out IPs associated with the fat pipe four times as frequently as for the thin pipe" (with 4 and 1 Mbps) and that's a load-balancing feature I would expect from a DNS solution rather than a router.

You'll probably end up with a cheaper over-all solution if you split your functionality into "router" and "firewall", that leaves you with one component that should scale to several tens (maybe several hundred) of Mbps for uplink speed, leaving the firewall to be dimensioned after the number of users.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .