Home Network Design

johnpoz

TP-Link seems to be the cheapest, are they good?

For a switch - I wouldn't go that route.. There are many a thread even here, and all over the net, even their own forums where they wouldn't let you remove vlan 1 from ports you wanted to put in another vlan, etc. Took them forever to fix, and then didn't port it backwards to their old models.

They said it was normal <rolleyes> on their own forums until they finally fixed it.. They don't seem to understand how vlans are suppose to work ;)

can I enable the VPN for a VLAN that is defined in L3

Yeah could policy route for a network that is downstream of pfsense..

Ubiquiti? These are quite expensive

Guess that is relative, they are very reasonable priced if you ask me - for what they do. You can pick up a lite model for under 100.. I show the uap-ac-lite over at baltic for 80$ currently. I believe they are sold out of their wifi 6 lite model, but that retails for 99$

Sure some of their higher end model are a bit pricey for a home setup, like the SHD which I would love to have to play with, but at $500 I don't want to play with it that much ;)

I have 3 of their AP currently, the UAP-AC-PRO, the lite and the LR.

JT40

@johnpoz Thank you.
The Ubiquiti switch you mentioned is this one?
https://store.ui.com/collections/unifi-network-switching/products/usw-lite-16-poe , 200 dollars/pounds new, not bad, even though I find it much cheaper on unofficial stores...

In this link you find the AP from Ubiquiti, in the bottom of the page, do you mean the first one on the table? U6 Lite?
https://www.ui.com/wi-fi#compare
Will I be able to separate the connection between 2 different devices and put them in 2 different VLANs?
As you understood, I'll have PfSense --> Switch --> AP, so the VLANs creation would be in the switch first, or directly in the PfSense box, not sure what's best :D , but at least I want to be sure that I can do it in somehow.
Basically, my WIFI devices have to be in different VLANs.

johnpoz

@jt40 not switch AP... I didn't recommend a switch.. Not really a fan of their switches..

Yes ALL of their AP support vlans.

stephenw10

@jt40 said in Home Network Design:

The idea is one of these 2, most probably the one with 24 ports
https://www.tp-link.com/us/business-networking/managed-switch/t2600g-28ts/#overview
https://www.tp-link.com/us/business-networking/managed-switch/tl-sg3452/#overview (they still release updates for this)

Those switches would likely be fine. TP-Links 'business' switches are a world away from their SOHO devices, might as well be a different company. I have a T1700G-28TQ and would have no problems recommending it, though only if you need 10G.

A PoE switch is not going to use 250W unless you have a load of PoE devices drawing power from it.

Steve

bingo600

Mixed up posts

~~It was my understanding that the OP already had a PoE switch , that might be "unsafe" to use with multi vlan (as L3 routing can't be disabled.~~

But if all the Cameras that need PoE , would be put in the same Vlan. Then why not try to use that switch for the PoE part, and just run a single "untagged" port from the "core switch" to the PoE switch.

~~Now the "core switch" could be a cheap xx-port L2 managble switch.~~

/Bingo

johnpoz

@bingo600 said in Home Network Design:

(as L3 routing can't be disabled.

huh.. What switch would be like that, even if supports L3 if you do not setup any SVIs it has no way to route.. Mine is in L3 mode, but it only has the 1 SVI used for management, so there is no way it can "route"..

bingo600

@johnpoz
Think i have mixed up this thread with another -- OOPzzz
Forget the above.

/Bingo

johnpoz

@bingo600 no biggy some of these threads are close in nature.. I for sure have done that a few times ;)

JT40

Thanks everyone so far, but this thread will be a bit in this way, I'll keep asking questions :D until I don't saturate your patience :D

I came across Cisco Meraki, I was excited for the price, support and performance, but guess what, this is what you find in the end of this thread: https://forum.netgate.com/topic/160537/pfsense-cisco-switch-ms220-24p/18

A Meraki switch is cloud managed and needs to be able to see the internet for it to work.

Here is what the lights mean: https://documentation.meraki.com/Go/Meraki_Go_-_Decoding_the_LED_Light

I would reset the Meraki switch to default and then connect to pfsense box.

See restore button: https://documentation.meraki.com/MS/MS_Installation_Guides/MS_End_of_Sale/MS220-24%2F%2F48_Series_(EOS)_Installation_Guide

I have number Meraki switches and if they cannot see the internet they do not boot.

I'm speechless, what about if my Internet goes down?? It doesn't even boot?
What about if it's already ON, does it turn OFF?

I'd like to take this switch precisely, if I don't go with TP-Link: cisco meraki ms220-24p
Not easy to find in the list of supported devices, not sure why , but you can find it here: https://meraki.cisco.com/lib/pdf/meraki_datasheet_ms_220_320_only.pdf

I think I like the possibility of having PoE ports for videocameras in the future, and why not, some other IoT device, so I'm also evaluating PoE switches.

bPsdTZpW

@jt40 said in Home Network Design:

Thanks everyone so far, but this thread will be a bit in this way, I'll keep asking questions :D until I don't saturate your patience :D

I came across Cisco Meraki, I was excited for the price, support and performance, but guess what, this is what you find in the end of this thread: https://forum.netgate.com/topic/160537/pfsense-cisco-switch-ms220-24p/18
A Meraki switch is cloud managed and needs to be able to see the internet for it to work....

Ugh indeed. Also cloud-managed devices offer manufacturers more opportunities to spy your network, and hackers more routes in. I chose a Cisco CBS350 several months ago, and have been pleased so far. It's not cheap (~$300 for the 16 port model) but it's full-featured (yes, all the VLAN stuff you're likely to need) and doesn't need any WAN connectivity (or periodic license renewals!) to work. For any switch, but especially more expensive ones, beware fake hardware or grey-market items.

bingo600

AFAIK the Meraki's needs a valid license , that will expire.
And you have to renew ($$$) the license, when it's expired, in order to get the device to work again. The device validates the license on/via the internet.

I did help a friend convert a Meraki AP to OpenWRT (requires a JTAG).

They're a bit like "Ink Jet Printers" ... Cheap hardware , but constant expenses.

/Bingo

AndyRH

I found an old Aruba S2500 on eBay for $120 a while back. 48 port, it has exceeded my need.
Just a thought.

JT40

@andyrh I found them used in UK, but no PoE...

The problem is that PoE became a requirement, the Ubiquiti AP, as well as many others, supports only PoE to power up the device, I'm really sick about this switch search, I couldn't imagine it was so painful...

That PoE model costs 360 used, the one without PoE it's around 150 pounds.
I don't feel to spend 360 pounds for an used item without warranty...

At this point, it makes sense to look at TP-Link or D-link, but guess what, the PoE models cost twice...

I think I'll look other APs in order to remove the need for PoE, but I won't be able to attach any videcamera to it, it's not a requirement now, but in the future it could become handy.
On the other side, I already spent 500 pounds (including import taxes) for my firewall, I exagerated due to the gaming requirement, I didn't want the firewall to cause any delay in DPI functions...
In any case, it seems silly to spend so much for a switch, which does only L2 switch job :D .
Maybe I'm missing something, I can't believe that everyone needs to spend around 1K between used and new hardware just to build home networks...

johnpoz

@jt40 said in Home Network Design:

I think I'll look other APs in order to remove the need for PoE

And then where do you mount them for good coverage? now you have to place them somewhere you have power to plug them in, and now you have not only the device with its network connection, also another power connection, etc. You don't need a poe switch to power poe devices. You can just use injector - when you buy single AP they ship with the injector. Pretty much any good AP is going to be poe..

While sure poe switch is cleaner deployment. If you only have a handful of them its not a problem to use the injectors. I have 2 injectors hanging off my core 28 port switch, but they are hidden behind the desk the switch sits on. And the other one I have coming off my switch in my av cabinet in the living room.. The injector is just in the av cab and not seen, etc.

You could also just get a lower port density switch that does your poe for your poe devices. Vs wanting to find a high port density switch that also does poe, now your talking more cost. Problem you can run into with that sort of setup is bandwidth limitations from the uplink from that switch into your network. But possible you could use lacp into your core from that, or possible a 10ge uplink from the smaller switch to your core switch, etc.

Also do you really need L3, do your routing at your firewall/router - pfsense vs doing it downstream in your network. Finding a high port density L3 switch with poe puts you into enterprise level gear, that is not cheap.. Normally not quiet nor power friendly ;)

Finding the gear that does what you want from networking perspective at home user prices can be a challenge for sure ;)

bingo600

@jt40

I'm using these for my UBI AP-AC-PRO.
And for IP Phones too.
My requirement was Fanless ....
So the C3750-24 PoE switch i was offered for free was not an option.

D-Link DGS-1100-08PV2
https://www.amazon.co.uk/D-Link-DGS-1100-08PV2-Gigabit-Managed-features/dp/B08MWJVWW1/

They have a "Power budget" of 64W , and would easily run around 4 AP's.

Do NOT go cheap , and get the 5-port (only 18W power budget)

/Bingo

johnpoz

@bingo600 said in Home Network Design:

C3750-24 PoE switch

Would of been a great switch - but not quiet nor power friendly that is for sure..

BTW - the whole core, distribution and access layers come into play as you increase the complexity of your network for a reason ;) The access layer switches is were poe would be, and you wouldn't be doing L3 there.. You would be doing L3 most likely at the core, possible at the distribution layer depending on how large your network is, etc. But poe normally not done at either of those 2 layers. Only at access layer.

Welcome to the fun of trying to setup enterprise level sort of network on shoe string / home budget ;) hehehe And also trying to make sure its quiet and power friendly - while enterprise level gear is neither since its normally hidden away in some dc or idf or closet and noise doesn't come into play..

A few years back had some work redo closets for customer - 3 3850s in stack in closets, man it was like jet taking off when you powered those suckers up in that tiny closet room ;)

JT40

@johnpoz Thank you for all the answers.

I don't see the PoE injector in the AP I listed, so I should buy it separately.

I'm not concerned about the power plug for one AP, I mean, it's a powerful omnidirectional signal, what could go wrong?
I'm currently running with cheap antennas, I think that the AP from Ubiquity has an excellent signal and wherever I place it, it will provide me signal :D , but that's my expectation, I may be wrong.

I don't need an L2 switch because my PfSense box will do everything at L3, I just need an L2 switch but the price is always the same... Unless I'm making some mistakle during my search.

For example, the one that was previously mentioned by @bingo600 is an L2 switch (HPE Aruba 2530-24G-PoE+ ), but used it costs 360, no PoE costs 160 (used).

JT40

@bingo600 I'd go for something more expensive if it's about D-Link, for 200 pounds I can get at least 16 ports, wait and I'll post the model.

bingo600

@johnpoz said in Home Network Design:

A few years back had some work redo closets for customer - 3 3850s in stack in closets, man it was like jet taking off when you powered those suckers up in that tiny closet room ;)

Add a few Pizza Servers too, and the noise becomes unbearable.
Especially in the first minutes, when they are "cleaning dust out of the bearings".

/Bingo

johnpoz

@jt40 said in Home Network Design:

I don't see the PoE injector in the AP I listed, so I should buy it separately

What AP are you buying? One of the new wifi 6 models - like the lite.. Yeah seems they have stop including the injectors - what a shame..

"Powered by 802.3af PoE (PoE injector sold separately)"

But for example the UAP-AC-PRO models
"*5-packs do not come with PoE injectors."

When you buy just single AP they do come with them, etc.