Network infrastructure help

[mic_y]

Hi guys,

I am busy with the planning stages of a network that I am looking to set up for a start-up I am involved with.

Currently we are running the following hardware:
-1 x DLink DSL-2500u ADSL Modem
-1 x TP-Link 24 port unmanaged gigabit switch
-3 x UniFi AP
-1 x FreeNAS server for storage
-1 x MS Server 2012 R2 running Domain Controller, RADIUS server, DHCP, Routing and Remote Access and a bunch of other services.

At the moment, everything is set up quite basically, with all the nodes plugging in directly to the 24 port switch.

I have no VLAN's set up at the moment and all nodes can communicate freely as they are all assigned addresses in the same 192.168.0.* range. Once connected to the network, there are currently minimal access controls in place, no VLAN's, etc.

I would like to implement the following technologies on this network, but seem a bit overwhelmed with options and a lack experience in deploying anything more complex than what I currently have.

The target structure for the network would need the following measures in place:
- A guest VLAN network (possibly only wireless but looking at also deploying 802.1x on the wired network connections), with access to only some of the services available - these would include: internet, a captive portal (busy developing this currently), as well as Plex.

-A corporate VLAN with access to file shares (still need to configure integration of FreeNAS and AD), all other services running on the network - This may still in future get segregated into additional separate VLAN's based on divisions, etc.

One thing that I need to mention is that the future structure will be used to serve VM's to "thin" clients, so latency and throughput will be quite essential. Initially the VM load will not be too heavy, but with time I am looking at supporting a nationally distributed network of clients connecting to VM's on the network. When the time does come (hopefully sooner rather than later) I will be investing in upgrading to a synchronous connection (fibre) to support employees logging in remotely to VM's to perform their duties.

What managed switch should I get to achieve what I want to achieve? This entire project is still in quite early start-up phase, so keeping costs down is a high priority. I am more than willing to consider 2nd hand units, but in terms of the network, I would like to keep the network running at minimum 1gbps speeds as far as possible.

I realise that the built in NAT firewall on the poor DLink router is being a bit overloaded with traffic as it is, and I am seriously considering deploying something like pfSense as a firewall/gateway to replace the existing setup.

 

[irBosOtter]

Layer 3 switch is what you need. Currently we use Cisco 3750's and 3850's
Two 3850's stacked, adding a 3rd this year, that's our core stack. All ESXi hosts are terminated on the core via ether channels

Core to dist stack is a layer 2 ether-channel

Then two 3750's stacked, our distribution switches. 17 Access switches (mostly layer 2 2960's) terminate via trunk ether-channel to the dist stack.
They are not cheap, never worked on any other L3 switches so maybe someone can advise on something cheaper.
But in a small environment like you have you can start off with just one L3 switch, or maybe the one L3 switch and one L2 switch, plug servers and other routers into L3 (core) and clients into L2 (access) switch.

 

[syntax]

you have pm

 

[mic_y]

thanks for the replies guys. much appreciated. lots of info to consider and evaluate.

 

[djshaunvt]

We have setup something similar at our college. Its working great.

Layer 3 switch with a few Vlans...

The Guest Vlan cant see other vlans only the Fibre router for internet access. Dlink Access points are running 2 SSID's one called Boardroom Corp Net and other called Guest Wifi.

People who connect to guest SSID get put on guest vlan and thus have no access to internal LAN at all.

Raidus is installed on windows Server 2008r2 and only computers who are part of the AD computer group can connect on the Corp networks SSID.. and dont need a key.

All this is done with Vlan tagging and it does sound scary at first but its actually very simple once you grasp the concept. It took me a few late night of swearing etc but once you get it working its amazing.

You can go as far as to put each port on a switch on a seperate Vlan. So every switch could have port 1 to 10 for guest pcs say in a reception area and every switch could have port 10 - 15 used for staff.. 15 to 20 used for HR users etc.


ANy info I could possibly help.

Shaun