Internet gateways (eg., cable modems, fiber optic gateways) don't function properly when they aren't behind a device with "layer 3" or routing capabilities, correct?

Incredibly long backstory

I'm in an argument with my boss about the root cause of our brand-new fiber internet connection (20/20 mbps) having full upload speeds (that wildly jerks between 17 and 20 mpbs on Speedtest.net), but miserable download speeds of 4-6 mbps.

My boss is convinced it's the provider's problem, but the installer said the light levels were "too strong," indicating a "perfect installation," and he had to turn down the output at the head/hub 3 miles away from us. The ever-escalating tiers of support people insist that all the data they see says our connection is working at the full 20/20 speed.

The topology is like this:

12-year-old 16-port dumb 10/100 Netgear switch
Fedora 12 server (2.6.32), the default gateway for the network
A "smart switch" Netgear ProSafe FS750T2
Two more chained FS750s (ie, the rest of the network)

No matter what (Vista, 7, Centos 6.5, FC12) we plug into that dumb 16-port switch, we get 4-7.5 mbps down. Any of our computers that route through the server test at the same speeds.

My boss plugged the server straight into the provider's layer 2 switch (the installer described it as a layer 2 switch without any routing capabilities, I don't know the technical term for "the thing that fiber optic lines are running into that also has a few RJ-45 jacks") and got the same results.

However, when a Vista laptop was plugged straight into the fiber connection, it grabbed a steady 20/20 connection from Speedtest.net. My boss chooses to discard that piece of data and insist that, because the server didn't function correctly when plugged straight in, it must be a Time Warner problem. (My theory is that something is broken in the ancient 2.62.32 kernel, or the server's second NIC to our LAN was somehow interfering with his test.)

As a test, I connected our cable modem into the dumb Netgear switch and configured a Centos 6.5 workstation (also running 2.6.32) to use our static cable configuration and... the network continually dropped out. Every ~5 seconds, I'd have to rerun ifconfig eth0 [ip] netmask and re-add the default route with route add default gw [ip] eth0. When the connection worked, Speedtest downloaded and uploaded at our full cable speed, but the fact it was continually dropping out (when it worked fine with the same configuration hooked directly into the modem itself) further leads me to blame the dumb switch for being the guilty party in our speed fiasco.

Edit: ethtool reports both NICs are running at 100 mbps, full duplex. That was our first assumption, that something wonky was going on there, but the fact we can get 20 mbps up, just not down, is a little odd.

I want him to purchase a firewall or layer 3 switch to connect our fiber internet and four public servers into. He won't oblige me.

Am I wrong in the assumption that a hardware router would solve our problem?

  • You have an ancient server that went out of support four years ago. Get rid of it. You also have an ancient switch... Those would be my two first suspects. – Michael Hampton Feb 4 '14 at 14:42
  • We're slowly migrating the FC12 server to a new machine that's running various Centos 6 VMs inside a Centos 6 host [one of the three other machines plugged into the dumb switch]. If there's some arcane Linux 2.6.32 issue with routing, which I'm sure there probably isn't, we'll still be in a bit of a bind. – Eric Lawler Feb 4 '14 at 14:44
  • Sounds like dying NICs in the old router or that old switch is faulty. Port negotiation settings could also be at fault, although I suspect something is just dying. Would you have even noticed this rate issue with your previous provider? – Caleb Feb 4 '14 at 14:52
  • @Caleb Maybe. The cable modem ran at ~12mbps down, 1.5 up all day long. But that was routed through a wireless router, then straight into the FC12 machine. The crusty-old switch was not involved in the process--it's only been connected to servers that themselves were connected straight into either the cable or T1 connections. – Eric Lawler Feb 4 '14 at 15:23

I read your entire question, and your last sentence Am I wrong in the assumption that a hardware router would solve our problem? no one here can properly answer even with the data provided. OH, and for grins I'll say that you should first check and see what kind of duplex/speed settings the ISP setup on their fiber handoff...as you almost always want to match theirs with static duplex/speed settings.

However, I will answer your title, Can internet gateways be plugged straight into a layer 2 switch? ...ABSOLUTELY.

I'll even give you a case in point. I've seen numerous 100Mbps and above internet connections where the ISP will provide an ethernet hand off (usually a simple biscuit RJ45 jack)...probably just like what you got since you plugged directly in with a laptop, etc...or plugged directly into the cable modem, etc.

A lot of times, there can be a need for the demarcation point for the ISP to be in a different room than some of the networking gear like the firewall, etc. that the true IP/endpoint will be on. For instance, if the company has multiple buildings on campus and wants to have the ISP put the demarcation point for that link in a separate building from the primary datacenter. In this instance, you'd simply have it plug directly into a layer 2 switch that has VLAN capabilities and extend the VLAN from the primary datacenter where the firewall/edge gear is, all the way through the network via Layer 2 VLAN until it reaches the switch the ISP's handoff is plugged into.

There also are times a simple layer 2 switch is used to create a poor man's DMZ or to setup a simple way to do HA between 2 firewalls and the ISP handoff.

Bottom line...yes you can plug an internet gateway straight into a L2 switch, assuming you know what you are doing and wanting to accomplish by doing so.

  • Hmmm... Your comment about the VLANs is intriguing. I never gave much thought to how larger enterprises would solve that particular problem. I suppose I've misread the general advice on the internet to mean "never use a layer 2 switch connected straight to your router," when they're really saying is don't do it unless you understand what's going on behind the scenes. You soundly answered the title. – Eric Lawler Feb 4 '14 at 14:58
  • @Eirik - you edited that both NICs are running at 100Full but are you talking about the 2 nics on the CentOS workstation running to the Netgear? That won't matter...you'd need to know what the negotiation is between the ISP's ethernet handoff and the next device (Netgear?). Or plug the CentOS box directly into the ISP and see what speed/duplex it gets. Even if it gets 100Full, hard set it regardless. Then test again. If it works fine at that point, then the dumb switch simply can't negotiate the link speed correctly. Get a new switch if you must...but make sure you can set the speed. – TheCleaner Feb 4 '14 at 15:03
  • Sadly, because that ancient switch is geared for the home market, it has no management tools whatsoever, so I haven't the slighest idea how to see what duplex it negotiated, other than noting that the lovely LEDs blink green for 100 instead of yellow for 10. – Eric Lawler Feb 4 '14 at 15:05
  • @Eirik It could still be getting half-duplex even with a 100 (green blinking)....ESPECIALLY if the ISP has their end statically set (typical). Try my comment above and let us know. – TheCleaner Feb 4 '14 at 15:06
  • 1
    Indeed, the old garbage switch was negotiating the wrong duplex. The new managed one was to (100 half), but permits a manual override setting of 100 full-duplex, definitively solving the problem. Thanks for all your insight. – Eric Lawler Feb 11 '14 at 13:12

I think your issue may be with Duplex settings, some of the older switches just don't negotiate it right.. and your server may have the same issues. When the server is plugged in, have a look at eth0.. or whatever port you are connecting. 10 to 1 it's set to Half Duplex.

P.S. Most people plug routers right into Layer-2 switches. :)

  • I gave @TheCleaner the official accepted answer for answering the stated question. I wish I could give you one for answering the unstated question! – Eric Lawler Feb 11 '14 at 13:11
  • His answer was much better than mine :) – NickW Feb 11 '14 at 13:15
  • Well you still got my upvote too @NickW. – TheCleaner Feb 11 '14 at 13:55

There are a lot of questions and possible problems here.

1) You can connect your Fiber into a layer 2 switch for sure. 2) Your dumb switch at the edge is ridiculous. What you probably have is a mismatched duplex setting and/or speed setting. Your home equipment needs to go. Then make sure the switch duplex mode and speed matches the other end. 3) If you don't have a router, then your ISP does the routing? Do you have multiple IP address to assign to each device? 4) You have a security issue here, no router, no firewall. So your servers are "straight on the Internet". Best way to get hacked.

So bottom line, your problem is not the lack of a layer 3 device as proven by the fact that you plug a laptop directly to the "fiber" (well not fiber since it's a copper cable) line and it works perfect. But then you throw in your dumb netgear home grade equipment and it drops speed, then that's your problem.


1) Get a proper device - layer 3 or 2 - to connect your servers to the Internet feed. 2) Ideally, get a router and/or firewall - I would say minimally a firewall - to protect your devices.

  • I enjoy your tough-love approach to this problem. 2) Will be working on this, per @TheCleaner's suggestions. 3) Yes, it's a /28 subnet. The FC12 box does the internal routing. 4) Agreed, but the boss feels the Linux machines jacked straight into the internet are adequately hardened. – Eric Lawler Feb 4 '14 at 15:13
  • @Eirik - French-Canadiens -- we're like that -- very direct :) – ETL Feb 4 '14 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.