Small branch office scenario

kayasaman · ‎11-29-2008

Hi,

first up I would like to thank the top "Net Pro's" for all their help in the past getting my 857W to work :-) as I had no previous Cisco experiance at all!!

About 2 years later I'm now on the CCNA and really enjoying it.

This question is kind of related to teh CCNA, and since my lecturer couldn't answer me fully I hope someone here could make some suggestions.

The scenario is:

For a small branch office with say upto 100 users and say 4 or 5 departments and 4 servers, what kind of equipment would be suitable to allow 100Mbps ethernet internet access and all the internal LAN conenctions connected at 1Gbps?

In CCNA part 1 it makes it clear that each department should be on it's own network. So taking teh network address of 172.16.0.0/16 and subnetting that so that the departments are on networks 172.16.0.0 to 172.16.4.0/21 and the servers on 172.16.5.0/21 - not worry about VLSM!

Chapter 2 talks about routing between different networks although a router is a gateway device used at the border of a network to connect it to WAN.

So what is a possible solution?

I thought of using a 1801 or 1811/1812 to use as the gateway therefore each subnet can be connected to it at 100Mbps for redundant links to WAN, as the 1800 series has an 8 port managed switch.

Then using something like a Catalyst 3560 24 port gigabit switch to provide the backbone between the subnets. Since it's layer 3 it can do some routing aswell as VLANs for necessary subnets.

Then using gigabit 2960's for the local departmental switches which would be connected to the 3560 via copper or fiber depending on teh distance to the department.

Since the 3560 I'm assuming has a NAT as it's layer 3 + 4 one could then include the ip NAT inside statement to enable all teh subnets to access each other so that socket communications can be translated between subnets.

And finally using a dynamic routing protocol such as OSPF to find the best path for both LAN and WAN communication between the local subnets provided by the 2960s and teh 1800 series router and 3560 main backbone switch.

Is this a feasable way to connect the network up?

It is a totally hypothetical scenario just so I can learn a little bit about teh 'real world' since I'm still trying to find a job along side teh CCNA.

Many thanks.

ihingos · ‎11-29-2008

You could do that. But you've made things pretty complicated.

In a real world senario....

Yes, it is a good idea to put departments in there own subnet, but you have too few users and devices for this to be of much good. You may want to simply keep everything flat.

The real problem though, is gigabit to the faceplate (ie. connecting all users at 1gbps). Where the problem hits is the uplink ports between network devices. You could use a couple for 2960G-48s and then create and ether-channel between a few of the ports for a trunk. OR if cost is not an issue, go with 3750G-48s. The new models have a 64Gbps Stackwise cable up the back for inter-switch connection.

From either option, you can pull a gigabit port off to run into your 1800 router.

using 2960s you'll have to configure inter-Vlan routing at the router, or using 3750s, at the switch level. You do not need NAT to route between Vlans. Just add the networks to whatever internal routing protocol you are using. OR if you have used 3750s, just enable IP routing. (on a cisco layer3 switch, it will automatically route for all the VLANs configured on it just by enabling routing).

kayasaman · ‎11-29-2008

Many thanks for the suggestions!

The part where I am struggling with is how to hook up the 1800.

At home I'm using the 4 ports of my 857W as a switch with a VLAN bridged with the Radio interface so everything connected to teh gateway uses only the 192.168.1.0 network.

We use 2801s in our labs with serial interfaces to support DCE/DTE emulation. Currently I am on chapter 2 of CCNA part 2 which is the routing part. So we are using the 2 fast ethernet ports of the 2801 to route between 2 networks which also can be considered as teh subnets suggested above.

However can the 1800s 8 port switch be configured in a similar way? [edit: as in giving them an IP address each then using that address as the default gateway? as oppossed to switching between VLANs]

I've never tried this on my 857 as I was directly instructed to create a VLAN.

Another agenda I had was to use this model to look at say if some departments where in another building so that one could make use of the SFP ports maybe base LX single mode to connect to one of the 2960s. Also how to keep costs to a minimum but still retaining good service. With the Cisco 1Gbps switches all at way over Â£1000 I shopped around other manufacturers like Linksys and Netgear to compare prices. Basically just to see how the blance of cost:performance ratio would be affected.

Of course the cheapest option here would be to link teh 1800 to few Netgear layer 2 and 3 switches configured in a similar way as suggested using the Cisco H/W.

Any thoughts?

I mean I know I have a long way to go before actually understanding this fully as I'm getting a little ahead of myself but at least it makes it good research in the hope of one day becoming a proffessional network engineer.

kayasaman · ‎11-29-2008

Although actually thinking about it, it might be easier as you said to use one subnet say 172.16.1.0/24 allowing up to 254 hosts perfect for the 100 users and connecting one of the 1800s ports to a say a layer 2 switch something like the 2960G with Vlans configured for each department. Then using a local unmanaged switch, say any cheapo Netgear or other 8 or 16 port depending on no. of users in teh department.

This would still enable 1Gbps connection between the host and the server and allow for fiber lines to remote departments say in teh building next door maybe. To simplify and reduce costs to teh lowest possible.

ihingos · ‎11-29-2008

The 4 ports on the 857, and the 8 on the 1800s are really switched ports. This is a tad confusing as the ports are on a router. Usually, to configure a switch port to be a routed port, you issue the "ip address" command. On the routers, this is different as some modules do not support this command. The trick is to use IOS 12.4 or higher, and assign each port to a separate VLAN. Then you configure the VLAN interface as you would a routed port. That should work on the 1800s, the 857 on the other hand, runs a slightly modified IOS and does not support this. (last I checked. A newer version of IOS may prove otherwise)

Something to add on routing. In a small network, with one router, using a dynamic routing protocol is over kill. There just are not enough routes, and they do not change often enough to spend CPU cycles (of course, this is not so much the case with the more powerful CPUs we have today).

On your 857 for example, your 4 switch ports are all on VLAN1, and then you have the one gateway port (F4?). VLAN 1 gets the NAT in command, F4 gets the NAT out command, and the only router you need is the gateway of last resort: 0.0.0.0 0.0.0.0 -> outbound interface (remember this for your CCNA)

I remember being were you are now. Seeing the big picture and how things work together helped me to understand the small things.

Remember that gateway of last resort though. That one command has bitten me more times then I care to admit.

kayasaman · ‎11-29-2008

Thank you so much for the great reply!!!

Yeah gateway of last resort is the default route for a stub network ip route 0.0.0.0 0.0.0.0 Dialer0 in my case (and in case of 1801) or it could be fa9 and 10 i think in case of the 1811 and 1812.

Also thank you for the tip on the usage of dynamic routing protocol in a small network it will definately be in my mind now so hopefully I won't make the mistake of implementing it.

[quote]

I remember being were you are now. Seeing the big picture and how things work together helped me to understand the small things.

[/quote]

It is so hard since I don't work in industry yet adn trying to find someone who can give me a chance to prove myself too is even harder as the current lack of jobs is a nightmare!

The only real life experiance I'm getting is with my little 857 if the NAT doesn't crash on me as I've got the IOS 12.4(6)T7 bug and can't upgrade the OS as I don't have a Cisco level 1 account :-(, and the 4 servers I built using varios distros of linux to do DNS, FTP, HTTP, SMTP, POP, IMAP SNMP, etc the list is endless :-)

But that's it! I really would love to be a consultant some day but getting that much needed industry experiance is the hardest I think.

At least my CCNA is going well so far which is a relief. And the dhcp pool and DNS server I built into the 2801 during CCNA part 1 really impressed my lecturer hehe for my second attempt I brought in my laptop with a server OS inside and configured the router to sync to it via NTP and also configured a DNS zone file in the server on the fly with reverse zone file then pointed the router to it aswell and forwarded ports needed for server access through NAT. Afterwards I configured SNMP and through use of a program called Cacti I created a mysql database and graphed all the interface statistics and CPU usage while storing the information in the db so that it wouldn't be lost over time. It was so much fun!

ronbuchalski · ‎12-09-2008

In order to better answer your question, could you clarify your network requirements?

1) You have 4-5 departments, and 4 servers. Are the servers shared among all departments, or is one server dedicated to each department?

2) Are the users evenly distributed across the 4-5 departments (25 or 20 users per department, for a total of 100 users)?

3) Are the departments geographically separated at the branch (different floors, different sides of a floor or floor, different buildings), or are they mixed located together?

4) Is there a need to manage different access and connectivity policies per department? In other words, do you need to control which departments communicate together, which departments are allowed to access the internet,etc? If not, then there may be no need to allocate different IP subnets to each department.

5) Your proposed IP subnets are very large. A /21 allows 2048 addresses per subnet. Why would you need such large subnets for an entire organization of 100 users? If there are no access control issues (#4 above) that you need to manage per department, you could put all users into one /24 Data subnet, for PCs, printers, etc. A separate /24 subnet could be created if you are going to support VOIP. And, if the servers are shared, you could put them into a third subnet, although they could share your /24 Data subnet.

6) Could you clarify the need for all internal LAN connections connected at 1Gbps? Do you mean that all user PCs, servers, etc have 1Gbps NICs, or are you saying that all users need to have the ability to transfer data at up to 1Gbps? These are two very different requirements, which would determine what you need to use at the edges of your network to connect to the users, as well as at the center of your network to support such high bandwidth connectivity.

7) When you state that you need 100Mbps internet connectivity, are you needing the ability to transfer data at up to 100Mbps to/from the internet?

I can answer more questions once I know the answers to the above questions.

Ron Buchalski

kayasaman · ‎12-09-2008

Hi thank you for replying! :-) and sorry for not replying sooner I finished my CCNA1 final recently and this week I took chapter's 1,2 & 3 from CCNA2 so I've been quite busy.

Now for your questions:

1) 4 servers; 1 is file split between departments using ACL's internally

2 is web (HTTP) and mail (SMTP, POP, IMAP)

3 + 4 are primary and secondary DNS

2) for my example scenario the users could be either but for simplicity say evenly distributed

3) Departments are between floors and seperated over 2 buildings with a common garden in the middle so land belongs to company.

4) Departments must not communicate together apart from mail and global file reposetory which is simply something like a drop box not for users to store data. All deps must access web.

5)I agree!! /27 would be better per department

taking network of 172.16.1.0/24 allowing for upto 30 hosts and 8 subnets.

Also we could do as you say use the 172.16.2.0/24 for VoIP phones as option for expansion later - I just wana get the basics understood before proceeding further!!

6) Sorry wasn't being clear: all NICS are at 1Gbps and so link speeds are at 1Gbps not 1Gps/user connection. Implying a switch needed of 1Gbps/port capability instead of 10/100.

7) Currently with my project network at home I have 16Mb adsl downstream so I meant 100Mbps synchronous internet connection. I think that means 100Mbps to and from the internet??

Thanks very much, and sorry I got a few bits muddled up it's really hard to get it right when you don't understand things 100% as I don't work in industry yet even though am trying to get in.

Kaya

kayasaman · ‎12-09-2008

With my limited knowledge and experiance I would think, revising my first idea above maybe an 1801 with adsl backup or 1812 router with a 2960 24 port gigabit switch or a Netgear 24 port gigabit layer 2 switch (if no funding available for Cisco one) with 5 vlans split between the 24 ports.

I might be able to get away with having perhaps a 5 or 8 port unmanaged switch linked to one of the ports in the vlan also.

And maybe a remote 24 or 48 port either managed or unmanaged switch using LX base fiber between the main switch and remote building. Then if I needed to branch off might use small unmanaged switches again.

Although if 100Mbps internet connection is that ethernet fiber?? Again something I don't understand.

Sorry for the confusion CCNA doesn't exactly give one an industry surrounding and I'm still looking for a vacancy. Like the way in CCNA they describe remote networks and the internet by a cloud is like my mind right now filled with confusion lol :-P

{The reason for this scenario is that in my project network at home I have 4 servers running lots of different services including mail and web, ftp, DNS, file and so on; using an 857W series router which only gives me upto 1Mbps upstream as is ADSL 2+ but also it seems to crash and timeout alot: http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=WAN%2C%20Routing%20and%20Switching&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cc281c0

that's why I want to find out how this would be done in reality as companies can't afford teh down time. Also maybe 800 isn't powerfull enough for 4 servers linked to web with clients also as I have 5 with more comming.

}