Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have seven Sites. Each Site contains about 15 to 20 users who are connect via ADSL and lease line. My question is how to design a network infrastructure.

To Solve above problem I Create One Domain Controller & Additional Domain Controller in Head Office. ADSL Line is connected to Sonicwall. Sonicwall provide the VPN connectivity. Lease Line is configure by using Cisco 3600 Router.On Site a place Sonicwall and establish VPN connectivity with Head Office.

Now my question is can i place child domain controller on each site. If yes whats will be the benefits. On each site Server 2003 is running. Currently i put the server 2003 in domain only.

share|improve this question
It would probably help to know what connectivity you need between sites and what services you expect to run over this network. – RobM Jun 10 '09 at 7:39
up vote 7 down vote accepted

It's really just a process of listing what you have, then listing what you need. Then using the first list (your assets) to build out a network that does what you need. You may have to buy things you don't have, to create the network which meets your needs. Like so:

  • First you make a list of the sites.
    • For each site, you make a list of what's there.
    • If possible, you list out what will be at each site in the future. This will help you plan a network that meets the future needs as well as current ones.
    • If you already have connections between sites, list these and their bandwidth.

Quick example:

  • HQ: 50 desktop computers, 8 servers, 3 networked printers. 1 VPN concentrator, 10 mb/s internet connection.
  • Site1: 15 desktop computers, 1 networked printer. 1.5mb/s ADSL internet; VPN to HQ.
  • Site2: 23 desktop computers, 2 networked printers, 5 POS stations. 6mb/s business cable to internet; VPN to HQ.
  • Site3: 17 desktop computers, 2 POS stations 1 networked printer. 1mb/s business cable to internet; VPN to HQ.
  • Site4: 10 desktop computers, 1 networked printers. 768kb/s business cable to internet; VPN to HQ.
  • Site5: 37 desktop computers, 2 networked printers, 2 servers. 6mb/s business cable to internet; VPN to HQ.
  • Laptop Users, mobile: 12 mobile users, each with home broadband or working from Starbucks. VPN to HQ.

You probably want to draw this as a map (lots of examples here). Print a couple of copies and then play on it with a pencil. Think about the connections which need to be made from site to site, and how much bandwidth they will use. Example: each desktop user might have a 50mb/s connection to the mailserver every 5 minutes. The servers at Site5 keep a continuous 1mb/s stream of replication traffic going with the servers at HQ. And so on. You'll get these estimates wrong, but they are a starting point that helps you see if you have enough bandwidth between sites. Later you'll put a little monitoring in place to get real numbers. But now I'm getting ahead of myself!

Next up you need to think about your IP addressing and subnetting plan. Will you be using public or private IP addresses? What the maximum number of IP's each site will need? Get out your subnet calculator and figure up how large each site's subnet will be. Decide which specific IP range will be used at each site. From here you'll decide what each site's internal gateway address should be (the external IP's in this example will be decided by the broadband provider, of course).

Now you decide whether you'll use DHCP to handle all those addresses (you very likely will). It will need to be configured - and you'll have to decide where to run it. At HQ, with ip-helper addresses at each site's router? Locally at each site from the routers there? Draw this into your diagram.

It's time to figure out your name services. DNS most likely - where will you put it? You could put all DNS servers at HQ or you could distribute them to each site. Once you've figured that out, add it to your DHCP config.

And so on, and on, and on. Basically you start with what you know, put it on the map, then start trial-fitting what you want on the map, until you have something that works. You commit your pencil annotations to ink. Then you build it.

Then you run it for awhile, and make changes as needed. Which you (or someone anyway) will keep doing until the company dies.

share|improve this answer

More information is going to be needed before a design can be suggested. In general you can use a hub and spoke model or a mesh model depending on the goals of the network. If you have a main location where your applications are centralized then the hub and spoke model can work well.

IF you need a more redundant structure and each site needs equal access to the other sites then you'll need a mesh like design.

share|improve this answer

If you have one site that is more of a central or "HQ" site, you could build a hub-and-spoke network. You could have some "centralized" servers reside in the HQ site, and use encrypted VPN connections from your satellite sites to connect back. A company by the name of Vyatta makes some very slick gear that offers a ton of IP services capability at a low cost.

They offer routing, firewall, nat, ntp (time), DNS, DHCP, and secure encrypted VPN tunnelling solutions to name a few. If i was putting something like this together, i would definitely look at their solutions.

Take a look at for a high-level explanation of network topologies.

share|improve this answer

You have to identify: - traffic pattern (do you have any central application? on which relations are main data transfers? ...) - what kind of control and security do you want to have? (centralised is normally easier to protect; you can quickly cutoff any branch office, ...) - what resilience do you want? (mesh/ring topologies are more resilient, but more complicated to setup)

Site/organisational hierarchy helps a great deal (any higher-level/central/lower-level offices?), as it usually defines all of above: traffic seldom flows between same-level offices, higher-level offices should be in control, ...

With this in hand, you can star searching, otherwise the answer is only a general: you'll need some switches and routers :)

share|improve this answer

It might also be worth your time to investigate an MPLS network. Most large providers can provide you with this service at a nominal fee above the normal price of the bandwidth.

Essentially, MPLS is point-to-cloud (diagram cloud, not magic-server-hosting-cloud), but you get your own private cloud. So suppose you have three offices, A, B, and C. Each of them have a, say, T1 to the MPLS cloud, and the provider itself routes traffic through the cloud to the destination, without ever touching the internet or anyone else's traffic.

The benefit of this is that you don't need to use VPNs on your MPLS links. They're inherently secure, since it's a private network already. Lots of people do run encryption on their links because they don't trust their provider, but that's something you have to judge and weigh the price versus how important your data is.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.