3
votes

Currently, our company network is pretty basic, consisting of two class C subnets, linked across a slow network connection via VPN. However, we are shortly moving into new premises.

Our new building is split into six distinct units, we are planning on occupying three of these, and leasing the other three spaces to other companies. I'd like to assign a subnet per unit.

We intend to use an additional subnet for our infrastructure (our company servers), and a further subnet for shared infrastructure (i.e. proxy servers), so that's a total of 8 subnets. I don't see a need to expand beyond that in during the life of the router.

I need to be able to set ACLs to allow or prevent specific subnet from being able to communicate with each other. I'm not looking at spending a fortune on features we don't need, just something reliable with 1Gbps connectivity with the ability to link to switches via fibre.

So the question is....

....My knowledge of router hardware can be written on the back of a stamp, so can anyone suggest any suitable hardware for the job? I have someone in mind (CCNA) to get the work done, so I guess anything Cisco would be preferred.

4 Answers 4

Reset to default
5
votes

I'm a network engineer and I don't understand your reason for the subnets. You appear to be using subnets to segregate areas within a building but you don't specify the reason for this.

The reason for subnets is three fold (in no particular order):

  1. To isolate collision domains
  2. To bridge geographically separate networks (not isloate them)
  3. Number of hosts per subnet.

If you are in a building with all these "locations" close, then, subnet or no subnet, you still need to route/bridge them over some medium (T1 (serial), fiber, copper, wi-fi, etc...)

That medium and traffic volumes usually dictates your subnetting if number of hosts per subnet is well under the max.

Cisco is an excellent choice - but to recommend a specific router, switch+router - I would need to know traffic requirements (fiber?, ethernet?) link speeds, etc...

4
  • All 6 units, could potentially contain between 100-200 hosts, subnetting will reduce broadcast traffic. Three of the units will be occupied by other companies, so isolation is a driving factor too.
    – Bryan
    Jul 10, 2009 at 7:11
  • 1
    200 IPs in a subnet is not considered large in terms of performance of a recent switch; even the cheap ones you can get from a local computer store; assumption here is we're talking about IP traffic only and well behanved applications (layer-7). Layer-2 is not a problem for this many IPs. However, having separate companies, makes sense to segregate into their own subnets but why are you routing or connecting all these subnets would be my question if they are separate companies presumable with their own servers and applications and such.
    – Kilo
    Jul 10, 2009 at 12:55
  • Okay thanks. Perhaps I'll just stick to one subnet per company then. The routing is because we are planning on including internet access as part of the deal to the other companies that rent space.
    – Bryan
    Jul 10, 2009 at 15:20
  • 1
    food for thought, then. If you are providing Internet access for the other companies (subnets) then I hope you realize that depending on how you set this thing up, you would be routing traffic over multiple RFC1918 addresses before NATting the outbound traffic. Or where you planning on giving each subnet their own NAT? or NATing their subnets onto yours? You have some things to think about and how they may related to hosted applications, SSL, etc... Again, I not knowing your complete goals/setup these are common points of consideration in such a setup.
    – Kilo
    Jul 10, 2009 at 15:59
2
votes

What kind of switch are you using ?
A Cisco 3750 as core switch can be enough. It can do routing and allow to have basic ACLs

2
  • I'm hoping to put a comms rack in each unit, and would like to have 1gbps connectivity between the switches and the central core router/switch. I was considering running fibre to do this. Fibre probably isn't essential, but whilst the building is still under construction, it seemed like a good time to put some runs of fibre in. I'm guessing the 3750 won't support fibre links though? If I stuck with copper, would I use VLANs and run one copper link from the 3750 to the other switch stacks around the building?
    – Bryan
    Jul 10, 2009 at 9:56
  • 1
    3750G-12S is a 12 SPF port model so that you can put in 12 Fiber SPF and get 12 fiber port. I don't understand the 2nd question, fiber or copper doesn't change anything to VLANs
    – radius
    Jul 10, 2009 at 12:13
2
votes

You may want to look Level 2 managed switches instead of routers.

You also may want to investigate using VLANs as well as subnets to further isolate and prioritize traffic.

Maybe something like the Cisco ESW 520 would work for you.

2
  • 1
    I wasn't knowing ESW 520. It seems that ESW-540-24-K9 could be enough as core switch for a small network. Of course it has less functionality as the 3750 but what about performance (when using ACL & cie) ?
    – radius
    Jul 9, 2009 at 21:51
  • I suspect the performance is fine as long as you aren't exceeding the number of clients with another switch plugged into this one. You have to assume Cisco wouldn't make a switch that couldn't keep up with the number of ports built into it (unless there is some crazy app the clients are running).
    – Adam Brand
    Jul 12, 2009 at 15:42
0
votes

If it was me personally I'd probably slap together some IPCop appliances, set up the VPNs I wanted and go from there.

If you want quick and easy though I'd think that pretty much any cheap/reliable VPN routers would do.

Based on the requirements you stated id in your question, I don't think any expensive equipment is necessary to get the job done.

Not the answer you're looking for? Browse other questions tagged .