What are my options in this type of small network setup?
-
Fun project.
I've started playing around with pfsense and I really enjoy it. Last time I used it was back in 2007. However the more I play with it, the less confident I become as I realise I really don't know enough. Even if I do get the whole thing up and running, I wouldn't be able to troubleshoot when it goes wrong.
I guess this is what happens when your boss pays network contractors to install the networks and send you on ccna just to change vlans or do patch cabling.
There's just so much to learn and think about. Like traffic shaping, private vlan, remote management, monitoring & keeping logs, spanning tree, NATing and how I'm going to recover when there is a hardware failure. I know the basic concepts but I don't know what is the best practice.
So I'm thinking of calling it off, but I'll give myself another few weeks to try it out. Just happens I'm going on training so let's wait and see if I'm more comfortable after that. Setting up something from scratch feels a lot scarier than just maintaining it.
-
Don't over-think it.
Nothing you have proposed is particularly difficult, I would say the biggest challenge you face is deciding what you want to do in the first place. There are some good suggestions above.Steve
-
I don't want to see him give up either. Nothing posed is too complicated. If the site was local we could knock it out on a Saturday.
BaNZ: Are you cancelling the 100M??
-
Thank you both for encouraging me to do it and I would really love to be able to set it up and learn from it. But I hope you understand that my knowledge with networks is fairly basic. I started testing it with my sfe2000p yesterday and I thought it was dead because I wasn't getting any dhcp leases. Reset to factory and still wasn't getting any IP. The manual says I should get a dhcp lease and be able to connect to the web interface. I eventually found a serial to console and then I realise there is no dhcp server running so the manual isn't correct. Eventually I got it up and running then I decided I want the latest firmware on it. I managed to find the switch on cisco website and there are 3.x and 1.x driver. I can't find any instructions on which one to use but I'm on 1.x so I just upgraded to the latest version. There was no patch notes for it.
After I got it up and running I logged into the switch and I have the option of putting it in layer 2 or layer 3 mode. The manual didn't tell me much apart from layer 3 allows port to have multiple IP which I'm assuming it is talking about trunking and vlans. So I put the switch into layer 2 then also I changed to standalone mode and not stacking as this is my only switch. I'm guessing I don't need to be in layer 3 because this is going to be done via pfsense? I probably need to spend an afternoon refreshing myself on layer 2 and 3 again. From what I kind remember layer 2 is just like hub/ unmanaged switch whereas layer 3 is your router / managed switch and it understands routing / tcpip.
I started configuring pfsense ,add some vlans, assign dhcp and push the vlans through the trunk port to the switch. Had a problem with vlans not working and Derelict helped me identify the problem with the firewall rule.
What worries me is a few things, like putting the switch into layer 2 and not knowing what it may effect down the project. Or logging onto the switch and I have these settings in vlan like ingress filtering, GVRP settings and Protocol group that I have no idea what they mean or do. The documentation for the switch doesn't explain these kind of things so I'm having to Google them and look at pfsense guide which I have to say it is superb and informative.
Next in my to do list is start testing the segregation of vlans and port forwarding.
I haven't order the 100mb line yet as I wasn't sure whether I'm capable of setting this up. I've got a few quotes and I know which one I'm going for. I'm waiting till next week to meet with the tenants to discuss the requirements and whether I'm able to provide the service.
I have to say I'm really enjoying it and learning new things!
-
You just want layer 2 on the switch. That will let you assign switch ports to VLANs, so each client gets a physical port/s that is in their own VLAN. Then setup the connection from the switch to pfSense as tagged for all the VLANs. Then setup the VLANs in pfSense on that physical port. Each client has their own VLAN straight through to pfSense. Now you have a bunch of VLAN interfaces on pfSense and you can set whatever firewall rules on those, port-forward whatever is needed to the occasional client that needs to offer some service accessible from the public internet…
Layer 3 on the switch means it would be router itself. You would only need that if there is lots of general traffic directly between clients. In that case layer 3 on the switch saves pfSense having to do that local routing. Does not sound like that is your requirement.
-
I have to say I'm really enjoying it and learning new things!
Isn't that great?!! I wouldn't stop learning new things just because I'm enjoying it. ;D
And honestly, if you stumble upon terms you don't know yet (mentioned GVRP) then probably you don't need the functionality at this moment. Just leave the settings in default state. -
Managed to get the tenants to take some photo of the current comms room.
What are those small white box adapters? Fax machine or adsl filters? I'm guessing the blue one is data as it goes into the switch. Can't see where the dark blue ones goes to, but I'm guessing it might be for their adsl line.
I think I really need to go onsite for a visit. I need to work out whether the current tenants are all sharing a leased line or having individual adsl lines. I'm pretty sure it is adsl as there is no cable provider for that area.
edit: oh no… it isn't resizing... I don't know how. The forum attachment isn't working either. Getting 413 Request Entity too large.
-
Those white boxes look like cable doublers(economisers). Horrible nasty things that need to be burned!
They are used to send two 100Mbps Ethernet connections down a single run of cat 5/6. The cable has 8 wires but you only need 4 for 100Mb Ethernet. The problem is there's no way to know at the far end that only 4 conductors are connected and if you try to connect Gigabit Ethrnet to it it won't work. Worse it may report that it's connected at 1000Mbps and then just not ever send any traffic! Many Gigabit cards have technologies to detect and prevent that scenario but some don't.Steve
-
Worse it may report that it's connected at 1000Mbps and then just not ever send any traffic!
I have had exactly this - wondering why the Gb did not actually go. Someone saving money 15 years ago installed dual outlets at each office desk point, but there was just 1 ethernet cable behind, 2 pairs for each outlet. But no fancy cable doubler thingy at the patch panel end, the 1 cable was split into the 2 x 2 pairs and each group of 4 wires punched down to the rear of each RJ45. From looking at the RJ45s at each end there is no clue that there are only 4 wires connected.
In those days it was only Cat5 cable anyway, so that would have been not up to Gb standard anyway, even with all wires connected. -
So do you install one on each end? One from the desk and another in the comms room?
I can understand why you would want to install at a desk to increase the number of ports. But why would you do it in a comms room when there's plenty of ports available.
-
Sorry to drift you off-topic for a bit!
At the comms room end you need 1 RJ45 for each RJ45 at the desk, so you can patch each to its own port on a switch. -
So do you install one on each end? One from the desk and another in the comms room?
I can understand why you would want to install at a desk to increase the number of ports. But why would you do it in a comms room when there's plenty of ports available.
It makes no sense. You would think at the back end both "ports" would go to the same switch port, which wouldn't work at all.
-
So do you install one on each end? One from the desk and another in the comms room?
I can understand why you would want to install at a desk to increase the number of ports. But why would you do it in a comms room when there's plenty of ports available.
It makes no sense. You would think at the back end both "ports" would go to the same switch port, which wouldn't work at all.
Splitting drops used to be a lot more common, it goes like this:
2x switch ports go to either 2x patch panel ports that are are split on the back and output to a single cable, OR they would go into one of those little "doubler" devices, which then plugs into a single patch panel port that maps to the actual run. Either way in the MDF/IDF/whatever end it ends up two cables by the time it hits the switch, but just one on the run back to the target office/room.
In the actual room you again would either have a doubler into a wall jack OR two jacks that are split on the back.
Terrible practice, but some people are penny pinchers and cable runs can add up (in materials and labor), sometimes there are also physical limitation.
If you're running one cable, you may as well run at least two, plus a lead of some sort… but then again it's probably been half a decade since I have done much wiring and more like 15 years since I've seen a split run like that.
-
Duh. Of course you need them at both ends.
-
Yeah but unless those devices do something other than split the wire pairs into two groups, it could be a mix of those devices, split jacks, or some other wacky implementation. Either way, it's worth tracking them all down and eliminating them.
-
They could merge voice and data onto one cable run and all sorts of wacky stuff.
-
They could merge voice and data onto one cable run and all sorts of wacky stuff.
You could even do ADSL data plus voice on a single copper phone line, but I digress :P
-
Yeah but unless those devices do something other than split the wire pairs into two groups, it could be a mix of those devices, split jacks, or some other wacky implementation. Either way, it's worth tracking them all down and eliminating them.
My guess is that it was put in to save money and I probably won't be able to get rid of them unless they spend money on additional cabling.
You could even do ADSL data plus voice on a single copper phone line, but I digress :P
In UK we get this quite often with our ADSL lines. I remember my internet getting cut off sometimes when the phone rings.
edit: Going to lock topic as it is getting too long and off topic now.
