Maximum IP adresses issued on LAN, and I can not get internet access.
-
Dude if I was trying to do something like this on shoestring budget I would deploy unifi AP, the entry levels are $70 - pros would be better at $200 each.
They are the cheapest AP with at least some enterprise features, etc. And a controller to give you details of how many clients, how they are connected, bandwidth used, etc. etc. Zero Handoff, etc.. Ceiling mounted POE.
https://www.ubnt.com/unifi/unifi-ap/
These would allow someone to just swap new on it, etc. Not sure how you expect someone to swap in a soho router as AP unless its been pre setup as AP, etc.
-
What's the budget for the project?
I am personally funding the test trial, budget is low of course.
What do you have in place for switching and PoE?
All Gig managed switches and 200 mb comcast connection
Are you running new cables to the optimal locations (usually in ceilings) or are you just putting them wherever there is already a run? If the latter, where are they typically located?
cat5e between gig switch to each AP.
Are you going to try to rely on meshing in any locations?
No.
What's the general building construction? here is their web site :http://thegardensplaza.com/
1 FT Cement floors, I am getting 3 floors with 75 % speed and very strong signal, there are cement columns in certain locations
How many floors?
15 floors - each floor has 14 units, building is 340 FT wide by approx 60 FT.
How did you arrive at the 18 AP number?
10 Apartments per AP. some what educated guess. Maybe If I put four per every other floor it would be better.
Seems WAY too low at 10.3 apartment units per AP.
Yes, you are right. the average age of owners is 50 to 60 years old plus is the demographic.
Initally , I think it will be enough, but when the season hits, I am worried. I have a 900 SF unit, and my family has 5-7 devices, multiple that by 185. Some units might have one.
What kind of performance is expected?
High, network should support video streaming Roku, apple TV and Amazon boxes, bandwidth is top priority.
Growth over 5-7 years (think about increases in associated devices)?
More bandwidth usage, not number of users.
Any other requirements (captive portal, multiple BSSIDs, etc)?
Captive portal, authentication
-
What's the budget for the project?
I am personally funding the test trial, budget is low of course.
What do you have in place for switching and PoE?
All Gig managed switches and 200 mb comcast connection
PoE?
Are you running new cables to the optimal locations (usually in ceilings) or are you just putting them wherever there is already a run? If the latter, where are they typically located?
cat5e between gig switch to each AP.
You didn't really answer the questions.
What's the general building construction? here is their web site :http://thegardensplaza.com/
1 FT Cement floors, I am getting 3 floors with 75 % speed and very strong signal, there are cement columns in certain locations
I call bullshit on this one. 1 foot of concrete decimates 2.4 and especially 5. What are the numbers?
As occupancy goes up, so does noise. What works in testing will fall on its face when you have everyone bringing in their phones and Mi-Fis on nonstandard channels. You want this to work well enough everywhere that they never even think about getting the Mi-Fi out of their laptop bag.
How many floors?
15 floors - each floor has 14 units, building is 340 FT wide by approx 60 FT.
How did you arrive at the 18 AP number?
10 Apartments per AP. some what educated guess. Maybe If I put four per every other floor it would be better.
Seems WAY too low at 10.3 apartment units per AP.
Yes, you are right. the average age of owners is 50 to 60 years old plus is the demographic.
Initally , I think it will be enough, but when the season hits, I am worried. I have a 900 SF unit, and my family has 5-7 devices, multiple that by 185. Some units might have one.
What kind of performance is expected?
High, network should support video streaming Roku, apple TV and Amazon boxes, bandwidth is top priority.
You and your users are going to be extremely disappointed.
Growth over 5-7 years (think about increases in associated devices)?
More bandwidth usage, not number of users.
Take another look at the trends. There's this current buzzword called the Internet of Things.
Any other requirements (captive portal, multiple BSSIDs, etc)?
Captive portal, authentication
Authentication against what?
-
You don't just throw some home wifi routers together and call it a trial for wifi to cover a building of this nature.
Unless your wanting to just give guest access in the lobby or something?
My suggestion to you is hire someone to do this correctly, or what is going to happen is spend money and time just to crash and burn..
As to your budget - low would be 20K for a project of this nature if you ask me for shoot from the hip number, and that dreaming low to be honest.
-
Just for hardware.
-
Yeah, exactly! That is not counting engineering cost, install, etc..
-
I second Ubiquity recommended in the above. They have this thing called 'seamless roaming' or something, which the people wil probably like.
If you have 1000 people on a 200 line, and they are all going to stream video, your 200 line probably isn't enough(?)
Also, have you considered security? If you put 1000 people in one LAN, they are all in the same LAN.
Now, people around here know me as the eternal noob ( ;D ), but shouldn't you divide your network, for security and control?
I could even envision you buying 185 Unify-UAP's, and install one in each condo. They are not expensive to begin with, and I think at 185+ units (spares too) you will get a fat-fat-fat discount (buy 250 units, get them for 50% perhaps). Of course, charging the condo-owners for this hardware makes only sense to me, so you keep it out of the implementation project.
Then, ideally, you could create 185 VLANs so you can control each condo separately (switch them off if they misbehave/shut down that part of your internet when the condo is empty/setup parental block lists per condo if they require so because of young kids, disable internet on a time schedule if they request so, block VLAN23 scriptkiddies on visit @ grandpa from trying to hack VLAN167, etc: all things you can't do with one huge LAN & DHCP - you can do DHCP within each VLAN, however).
Of course, and this is what I don't know but I am sure the seniors in here do know: is there a way of connecting 185 VLAN's without having to use 185 physical NIC's?
Finally: you for sure will want CARP, and I really think you will need multiple 200 lines. Ideally you'll setup traffic shaper between them to balance the load.
This' all noob-thinking. Seniors in 3-2-1 to shoot me ;D ;D ;D
-
If your going to put a AP in each condo - why even bother, since you would need a wire to each condo in that sort of setup. Let them buy and setup their own hardware, you just provide the jack, etc.
As to need 185 nics for a 185 vlans?? No your router would not need 185 nics ;)
-
@Mr.:
I second Ubiquity recommended in the above. They have this thing called 'seamless roaming' or something, which the people wil probably like.
If you have 1000 people on a 200 line, and they are all going to stream video, your 200 line probably isn't enough(?)
Also, have you considered security? If you put 1000 people in one LAN, they are all in the same LAN.
Now, people around here know me as the eternal noob ( ;D ), but shouldn't you divide your network, for security and control?
I could even envision you buying 185 Unify-UAP's, and install one in each condo. They are not expensive to begin with, and I think at 185+ units (spares too) you will get a fat-fat-fat discount (buy 250 units, get them for 50% perhaps). Of course, charging the condo-owners for this hardware makes only sense to me, so you keep it out of the implementation project.
Then, ideally, you could create 185 VLANs so you can control each condo separately (switch them off if they misbehave/shut down that part of your internet when the condo is empty/setup parental block lists per condo if they require so because of young kids, disable internet on a time schedule if they request so, block VLAN23 scriptkiddies on visit @ grandpa from trying to hack VLAN167, etc: all things you can't do with one huge LAN & DHCP - you can do DHCP within each VLAN, however).
Of course, and this is what I don't know but I am sure the seniors in here do know: is there a way of connecting 185 VLAN's without having to use 185 physical NIC's?
Finally: you for sure will want CARP, and I really think you will need multiple 200 lines. Ideally you'll setup traffic shaper between them to balance the load.
This' all noob-thinking. Seniors in 3-2-1 to shoot me ;D ;D ;D
Pretty much nails it on the head. Nice to see an eternal noob outsmarting his masters ;-)
In this particular case you need a cable run in each condo. That cable should be connected to a ubiquity AP, to provide internet service in each condo separately. Then on the other end, it should be connected to a layer2 managed switch, to isolate each AP onto its own VLAN.
That switch should be connected to pfsense, each VLAN should have its own interface on pfsense. Yes that means all 185 interfaces declared on pfsense, but all of them combined over a trunk (tagged) link to the switch, which will handle the "separation" of traffic according to its VLAN.
It's the only way to do this project, every other suggestion/idea is a disaster in the works.
You don't put separate houses/appartments/tents on the same subnet. EVER! Two reasons for that: 1) network isolation and 2) broadcast traffic. Each appartment should have its own /24 subnet. The reason for that is that you set it once and forget it. It's not like the building will get any sizable increase in the number of appartments. Each /24 has 253 usable addresses, more than enough for any appartment.
Having every appartment separate means that you can traffic shape/limit each appartment separately plus traffic is kept isolated in between them. It will take a LOT of work to set everything up on pfsense, but it's a set up once and then forget it investment. In the process you will have learned something new.
You will need a cold standby for the switch, as well as a carp cluster for pfsense. The reason you can't have two switches on warm (active) standby is that each AP will only have 1 ethernet port, so you cannot connect both switches at the same time. You can however keep them both wired up to pfsense, and all you'll have to do in case one fails is to unplug the APs from one and plug them into the other and power it up.
There is no other way to do it correctly, please stop wasting your time looking for solutions that WILL end up in a disaster.
-
@jflsakfja:
It's the only way to do this project, every other suggestion/idea is a disaster in the works.
Not.
You don't put separate houses/appartments/tents on the same subnet. EVER! Two reasons for that: 1) network isolation
that depends on whether you are giving everyone a public and a firewall or, like OP wants, a wireless private network.
185 stations is not that many. To do it with VLANs and public IPs you'd need a /22 and at least a /30 to every unit.
If issuing privates, there is no reason not to use one subnet, DHCP, and private vlans to isolate the users from each other.
Also, since we are talking about pfSense, you have a lot more flexibility for traffic shaping when you're dealing with one interface to the customers. OP is going to need shaping, or at least limiting, guaranteed.
and 2) broadcast traffic.
Yes. Though 185 still isn't that huge. We're talking all gig. With proper layer 2 isolation you're not dealing with broadcasts from all the clients - just the gateway and whatever other servers might be set to unprotected.
Then, ideally, you could create 185 VLANs so you can control each condo separately (switch them off if they misbehave/shut down that part of your internet when the condo is empty
config t
int eth 2/1/34
disableOr put the port on a VLAN with a web redirect that goes to a page telling them who they need to call to get reactivated.
/setup parental block lists per condo if they require so because of young kids,
I would never, ever subject my employer to such liability.
Each appartment should have its own /24 subnet. The reason for that is that you set it once and forget it. It's not like the building will get any sizable increase in the number of appartments. Each /24 has 253 usable addresses, more than enough for any appartment.
Eliminating the wireless requirements, I'd give them all a wired public, lock it down (DHCP snooping, etc), and be done with it. pfSense for shaping/limiting, NAT off. And maybe develop a preconfigured consumer router to sell/rent/lease/recommend. Or they can run their own pfSense if they want :). Go all in and give everyone a /56 too.