PIX and Switch VLAN Question

[rasoftware]

I need a bit of advice on a setup i'm proposing.

We want to use a switch 2950 or similar L2 switch to create multiple VLANs to give to each customer at our site which we can do. Inter-VLAN routing is not required. I want to provide each with internet access by plugging in a PIX or router into one of the switch ports to provide VLAN trunking to the whole switch and the VLANS. I also want to use the DMZ port on pix/router to provide non-natted connections also for those that want it. I also want to have some kind of QoS to restrict each VLAN port to a maximum bandwidth.

I don't have the hardware available at them moment to test this but does it sound possible?

1) Am I better using a PIX or router. I read somewhere the PIX wont support VLAN trunking?

2)Is QoS the correct thing to be using to restrict bandwidth? ie if the pay for 200Kbs I can restrict that port to 200Kbs.

3) Would a layer 3 switch be better and just a simple router as a gateway?

I've attached a diagram of what im trying to do!

[sean]

With pix version 7 and at least a PIX 515E, you can trunk. You just create the subinterfaces required on the PIX, but there is a limit to the number of subinterfaces allowed.

QoS will work for rate-limiting, but will depend on where you are trying to impose the limit. For example, if you have a simple layer 2 switch and a router, you would only be able to rate-limit only on the router interface. This would be fine for downloading (from the end-user perspective) but uploading is not rate-limited until it hits the router interface. This might cause an issue if too many individuals have a virus on their network connection, and kill the switch. Higher end switches allow greater functionality at the port level, but they cost more.

Depends on what kind of layer 3 switch you were going to use. If you used something high end like a 4500 or 6500 (with the right sup), that would definitely be better than a low end router (just depends on the budget and application). If it is only a 3550, then it is nice, but you loose some of the features on a router such as NBAR. This may not be a big deal, but if you are trying to clean up traffic and make it more efficient, NBAR definitely helps.

[rasoftware]

Hi, thanks for the info.

What I would be looking at is a single VLAN per port. The clients would then use this port as access to the internet. I would like to limit upload and download on a switch single port is this possible?