2 Switches, 2 LAGGs, 1 LAN

scilek

Hi

I am setting up a new router for a small student hostel. The students will all connect via the 12 Unifi Access Points. The problem is that there are two blocks and I want to install one switch for each block in order to cut down on the CAT6 cable. The distance is not that great and the cost is not an issue at all –I just want to ensure maximum performance. I have installed one IBM Intel 4-port GB PCI-E NIC and one Intel Pro M PCI card. I also have the onboard RealTek PCI NIC.

I want to connect two gigabit interfaces on each of the HP switches via LACP; LAGG0 for Switch A and LAGG1 for Switch B. But I also want to make them one single LAN.

Is that possible? If yes, how do I do that?

johnpoz

You would do that with your distribution layer switch.. Network design 101, your typical access, distribution, core..

So your laggs would run to your distribution layer switch, which would then connect up to pfsense.

Pfsense is not a switch.. So unless you have the sg-3100 running pfsense that has a built in switch your best bet would be to put a switch between… Why are you wanting to lagg.. What is the internet speed here? Is your internet faster than 4 gig? Do you want the lagg for redundancy? Sounds like you want it for bandwidth.. Whats the point of feeding possible 4 gig into pfsense to route to internet that is only 512? for example..

Why would you want/need them on 1 lan? You almost never see a wifi network, especially in some sort of setup like a hostel where wifi device would need to talk to another device on the wifi.. Such networks wifi are almost always setup isolated.. You don't want device A talking to device B because you get some "hack0r" wannabe or someone infected with something talking to all the other guests on the network, etc. So see no reason for the 2 areas of wifi needing to be on the same layer 2..

scilek

So your laggs would run to your distribution layer switch, which would then connect up to pfsense.

I don't have one and it would be an overkill. I also want to keep both switches at the same level of distribution.

Is your internet faster than 4 gig?

They wish!

Do you want the lagg for redundancy? Sounds like you want it for bandwidth..

I want both.

Why would you want/need them on 1 lan?

Because I want to be able to manage ALL the Unifi APs from a single laptop and hence a single broadcast domain.

You don't want device A talking to device B because you get some "hack0r" wannabe or someone infected with something talking to all the other guests on the network, etc.

That is not an issue at all.

scilek

Well… I see that is not recommended at all.

But is it still possible?

johnpoz

Yes it is possible - just bridge your 2 lagg interfaces.

But not a recommended setup.. Just put a cheap smart switch that can lagg infront of pfsense. In a normal setup this distribution layer switch in front of pfsense would be a stack. With 1 leg of each lagg connecting to different switch in the stack. So then you get true redundancy while allowing bandwidth. But if you do not have anywhere close to 4gig then you have no need for the extra bandwidth and complexity of the lagg setup.

As to managing your 2 different layer 2 from the same controller - this is simple via L3 adoption of your AP that are on the same layer 2 as your controller.

There are many ways to skin the cat so to speak.. The distribution switch in front of pfsense would be the most direct and easier setup and less complex. It does not have to be an expensive switch for sure.. A $50 smart switch can do lagg for example. This would be better solution than bridging your lags in pfsense to maintain them all on the same layer 2.

scilek

But not a recommended setup..

Thanks for the advice. I had to buy a brand new "HPE OfficeConnect Switch 1820 24G J9980A" switch, which turned out to have basic core switch capability.

Derelict

Good. That should absolutely be done in your switching layer.

johnpoz

"which turned out to have basic core switch capability"

Any switch could be your core to be honest.. It doesn't have to do routing, etc. It could be a dumb switch.. The nutshell of the access, distribution, core is just a pyramid way of looking at how you fan out your network from the edge to the devices.

Such a layout as attached, be it all dumb switches could be seen as top switch as core, middle as distribution and bottom row as access. With your devices connected to the access layer.

It for sure can get way more complicated than that, and normally there is stacks with redundant connections, etc. If all you have is access switches directly connected to pfsense then pfsense becomes your combo core/distribution layer, etc. Or you could look at it like you don't have the core or the distribution layer, etc.