Home Network Design

bingo600

@bingo600 I'd go for something more expensive if it's about D-Link, for 200 pounds I can get at least 16 ports, wait and I'll post the model.

If you go for D-link in the "Core layer" i'd chose a DGS-1210
The 1100 is fine for access , but no mac-filtering capabilities etc.

Seems like the 1210-28P has PoE on the first 4 ports
https://www.ebay.co.uk/itm/255189622837

But i'd prob bid on this (non poe) , and add a 1100-poe
https://www.ebay.co.uk/itm/125003856229

If (when) your PSU dies, it's better to replace a £100 device then a £300 device.

/Bingo

JT40

This is the D-Link model with 24 ports (D-Link DGS-1100-24PV2 24-Port PoE): https://www.scan.co.uk/products/24-port-d-link-dgs-1100-24pv2-gigabit-smart-managed-switch-12x-gbe-poe-12x-gbe-100w-budget-web-ui-gr

The price seems good for a new product, I just need to find a store that has it :D

johnpoz

@jt40 said in Home Network Design:

excellent signal and wherever I place it

Not really true - and especially if wanting "GOOD" coverage and at 5ghz.. Sure depends on the size of your home, and what sort of materials made up of and walls, etc.

But can almost promise you if you want great wifi coverage in all areas of your house, more than 1 AP prob going to be required..

I have a small ranch style house, just thin wood walls.. And I have 3 AP, pro in the center of the house, 1 in the kitchen near the patio door to give me better coverage out on the patio, and then on on the other side of the house in the guest room to give good coverage on that side of the house.

You will also might want more than 1 AP to spread your wifi out over multiple AP vs every device on the same one.. Now if all you have is a couple of phones and a tablet, that you really only use in limited area of the house.

But if you have iot sort of devices, etc. You prob going to want to spread the load over multiple AP..

JT40

@johnpoz Thanks, well in my case is not a problem of number of devices, it's just about coverage, currently with cheap TP-Link I'm able to get coverage on the entire apartment, so I'm not worried about it, unless the Ubiquiti has a weakness in that.

I only need their AP because I need the client isolation, which currently I don't have.

JT40

@bingo600

Thanks, I think I'll take this one used: https://www.dlinkmea.com/index.php/product/details?det=QlRYYTFvOG5INURLeUxLcm9xanlDUT09

I'm not sure about the domain of that website, but it's where I could find more informations, otherwise on the official website there is nothing, very weird...
https://www.dlink.com/en/products/dgs-1210-28p-28-port-gigabit-smart-managed-poe-switch

In any case, the TDP is low and I don't need to have 2 switches (double energy consumption), all the ports are PoE, with the first 4 that can provide more power, they should be PoE+, for me it's good in the same way.
I found it used, otherwise it's more than 300 pounds brand new, it's around 450-600...

Ok for the suggestion on a 10 ports switch, but that would probably imply to get a second one, which will result in more energy consumption, let's say max 5 pounds a month which will make the price of the switch in ~1y... (50 pounds used)
I think that spending 100 pounds on that 28 ports switch PoE is a good deal.

bPsdTZpW

@jt40 said in Home Network Design:

Thanks, I think I'll take this one used: https://www.dlinkmea.com/index.php/product/details?det=QlRYYTFvOG5INURLeUxLcm9xanlDUT09
I'm not sure about the domain of that website, but it's where I could find more informations, otherwise on the official website there is nothing, very weird...
https://www.dlink.com/en/products/dgs-1210-28p-28-port-gigabit-smart-managed-poe-switch

Don't you just love the domain name ecosystem, where anyone can buy almost any domain name, and legit organizations use several domains willy-nilly without giving users any real way to validate them? (Try a whois lookup on dlinkmea.com ; I get the contact info of a privacy shield company in Florida, USA). And the cert for the site is just domain-validated, so I can't use it to determine, even provisionally, which organization owns the domain.

Sometimes I wonder whether the whole domain system wasn't designed by phishers for their profit and amusement.

JT40

@bpsdtzpw I wasn't in the conditions to check it yesterday evening, but yes, cert issued by Kaspersky and domain managed by a company in Florida ahahah.
I was browsing just to avoid trusting the store description, both match, so it seems reliable :D , I just wonder how the hell they don't have these details in the official website...
In the end, it's not a new products, but not even decommissioned.

bPsdTZpW

@jt40 said in Home Network Design:

@bpsdtzpw I wasn't in the conditions to check it yesterday evening, but yes, cert issued by Kaspersky and domain managed by a company in Florida ahahah.
I was browsing just to avoid trusting the store description, both match, so it seems reliable :D

Interesting The cert it serves me is issued by CPanel as intermediate to Comodo, with SHA256 fingerprint 41:A6:F1:A2:CB:2C:91:54:30:78:7C:45:0C:FF:C2:C4:6F:D9:7D:E5:0D:01:96:40:1C:09:94:0B:D6:5A:4E:DA . This is cert https://crt.sh/?id=5515086855 . I guess you're using Kaspersky as security software?

, I just wonder how the hell they don't have these details in the official website...

Some manufacturers sell some products in only certain regions. Still, there should at least be some official link from the well-known manufacturer site to the unknown site.

JT40

@bpsdtzpw
CN = dlinkmea.com ,
DNS Name=www.dlinkmea.com
DNS Name=dlinkmea.com
DNS Name=mail.dlinkmea.com

The domain doesn't refer to the original one.

Regarding the cert validation, I don't think that means that I'm using Kaspersky, even though it could use the trust store from KS, it can't override who issued the cert, but that's what I get on the browser, I should use the console or a third party service, I'll check.

JT40

In the end I couldn't take more than a 10 ports switch, anything above it has 2 fans, which is untolerable with 45 dB(A) noise at minimum speed...
That 10 ports switch has PoE on 8 ports + 2 SPF, not sure how I will use them but I think thst SPF ports can be used as normal ethernet.

If I need to expand in anyhow in the future, I can get somethig like this DGS-1210-24, it's fanless but no PoE, which is fine.
I'm simply not sure how it will behave after the 10 ports switch... Shall I tag the same VLAN when it comes to a simple expansion?
For example:

DGS-1210-10MP E1 connected to E2 (just to avoid confusion on the thread - E stands for Ethernet port) in DGS-1210-24, shall I tag the same VLAN ID (let's assuume VLAN 20) also on the DGS-1210-24 when it comes to a simple expansion of ethernet ports on the same VLAN?
The idea is getting other 24 ports on the same VLAN 20 created on the switch DGS-1210-10MP.

Does this setup support client isolation at the latest switch level?
Will the firewall be able to manage the routing of each machine connected to the network? It seems obvious if I get over the DGS-1210-10MP :D , but the machines will be after 2 switches, hence the doubt. In networking it should be possible, but I'm not sure with these devices.

johnpoz

@jt40 if switches support vlans - then yes you can pass vlans between switches.. Not sure what your questions or concern is to be honest.

Yes the uplink between switches would be a trunk port and allow the vlans you want.

bPsdTZpW

@jt40 said in Home Network Design:

@bpsdtzpw
CN = dlinkmea.com ,
DNS Name=www.dlinkmea.com
DNS Name=dlinkmea.com
DNS Name=mail.dlinkmea.com

The domain doesn't refer to the original one.

Regarding the cert validation, I don't think that means that I'm using Kaspersky, even though it could use the trust store from KS, it can't override who issued the cert, but that's what I get on the browser, I should use the console or a third party service, I'll check.

If you're not using Kaspersky security software, this probably should not happen. [1] Please post the SHA256 fingerprint of the leaf cert that the domain is serving you.

[1] Some security software acts as a MITM proxy to deep-scan HTTPS traffic. To do this, it needs to serve your browser a cert ultimately rooted in a cert that your browser trusts.

bPsdTZpW

@jt40 :In the end I couldn't take more than a 10 ports switch, anything above it has 2 fans, which is untolerable with 45 dB(A) noise at minimum speed...

Cisco CBS350-24P-4G ( https://www.cisco.com/c/en/us/products/collateral/switches/business-350-series-managed-switches/datasheet-c78-744156.html ) has 24 ports, 195W PoE+, and no fans. I haven't tried it, but I've been pleased with the 16-port no-PoE fanless version I currently use.

JT40

@bpsdtzpw I'm using it, but I find it very weird.
This is the SHA a84c393949a841252f20085b9c33c120f6711f15

JT40

@bpsdtzpw ahaha, the 24 ports is 700 pounds, which is understandable considering the features, TDP and PoE.
All the others are also quite expensive, they are the most recent devices from Cisco if the website doesn't lie.

stephenw10

I have a Brocade ICX6450-24P which is an older device but it's a real enterprise switch with all the features you could ever want. It has 2 fans but they are not too loud. I swapped them out for quieter ones and it never gets hot. I only ever run a few APs from it though.
They can be had surprisingly cheaply when they comes up for sale. The 6430 model even cheaper.

Steve

bPsdTZpW

@jt40 said in Home Network Design:

@bpsdtzpw I'm using it, but I find it very weird.
This is the SHA a84c393949a841252f20085b9c33c120f6711f15

I can't find that cert at https://crt.sh , which contains info on network certs issued by most reputable CAs. Also duckduckgo and google don't show any matches. Please post the cert's serial number.

JT40

@bpsdtzpw Serial number: 4200000210619acc88

JT40

I just purchased this https://store.ui.com/products/unifi-ap-6-lite
Am i good to use such PoE convertor? 802.3af PoE Injector (48v)

Unifi-ap-6-lite requirements:
Supported voltage range 44 to 57VDC
Max. power consumption 12W

It seems good :D

I gave up on the PoE switch, it was not available :D , maybe in the future I'll think to some 10 ports switch only to use PoE.
As usage, I can only think of videocameras for now.

JT40

@bpsdtzpw It's possible that Kaspersky is doing something with it, but normally the cert should not be changed...

In any case, on the EMEA website there are all the product informations, but not on the international version, probably US.
https://eu.dlink.com/uk/en