A small office & home network project, feedback welcome.

S

sajunky

Honorary Master
Joined
Nov 1, 2010
Messages
13,120
Reaction score
276
Location
JHB
Components:
- 20/20Mbps fibre Internet connection
- a new router in the the same metal cabinet (no WiFi)
- only few PC's, printers, WiFi devices,
- Yealink base station with 3 VoIP phones,
- 2x WiFi Ubiquiti Unify UAP-AC-IW or -LITE version one in the office (garage level), another one in the living room. It should cover the entire two-storey house (open space living area with bedrooms around on the first floor).

Currentlly the old router is used - Fast Ethernet and WiFi, but it seems struggling with 40Mbps link.The initial project included a new router and a managed Gigabit switch to give a wired connection in every room, but all cables are still not in the conduits and there is a rush for a temporary solution.

Router: Mikrotik hEX RB750GR3 or Ubiquiti EdgeMax ER-X. Both are dirty cheap, available locally from Uniterm Direct. They are built on similar hardware with all Gigabit hardware switched ports, capable serving 100Mbps connection with ease. I decided for the later one due to the fact I am unable to read Mikrotik Linux-style manuals (having allergic reaction) and there is no provision for offline reading.

Proposed connections:
eth0 - WAN port for Internet
eth1 - Connection to the old 5-port unmanaged Gigabit switch located in the office
eth2 - Ubiquiti Unify UAP-AC-IW located in the office (getting 2 extra Gigabit ports)
eth3 - Ubiquiti Unify UAP-AC-IW or -LITE located in the living room
eth4 - Yealink base station for VoIP phones located in the office

Easy part. I want traffic separation for the VoIP base station (no reason, but something tells me it will be better if working standalone), so I connect the cable not to the dumb office switch, but directly to the router and configure base station IP on a different subnet.

Difficult part. Both WiFi AP's must be on the office LAN, but I want TV connected to the WiFi to be separated from the office LAN. It is because of running odd apps on the TV Fire Stick. :) :) :) In addition, for the TV it must be a provision for geolocation blocking (smart DNS proxy or VPN, or both). I know that Unify AP's have a guest network feature, VPN (whatever) so TV can be placed on guest network, VPN, theoretically no problem.

How this AP guest network isolation works in practice? A different LAN subnet or VLAN? Do it require configuring VLANs on the router? I have no idea. I read manual, Edge router OS can obviously do it all, but I would like to know details. Maybe I would have to give up on using 9K jumbo frames on the office LAN, due to the router's MTU limitation on VLAN. And due to the connecting a dumb switch to the same LAN, router would have to handle stripping and recreating VLAN tags as well. Untagged VLAN? Any thoughts?

There is no separate manual for Ubiquity WiFi access points. Reading manual for Unify Controller software is confusing, as they constantly mix referencing to the AP on one side and USG router or Unify switches on the other. By example there are various options for defining network type: Corporate, Guest and VPN variety, then they say these options are only for use with USG and VLAN-only type is only for use with Unify switches. There is nothing left for non-Unify router/switch. I guess everything is there, but must be done manually. :)
 
Last edited:
Backup Electricity so when the power is off you can carry on as usual...smart DNS proxy works well I have it on a DDWRT router and i have blocked the google DNS,s as well 8.8.8.8 and 8.8.4.4 :)
 
Mikrotik has a GUI interface application as well, doesn't need to all be linux coding. I do not have much experience on the Ubiquiti Edge equipment so not able to comment there.

Yes theoretically the VOIP will be better being on its own subnet, but you still need to queue the data as to not cut the VOIP traffic off.

Guest network will work quite fine for your TV setup. Yes, guest network and "office network" subnets do not see eachother.
 
Get a managed switch, Edgeswitch 8 or 16 PoE works well:

Put PC's/printers/UniFi on default VLAN 1

Put Yealink device on voice VLAN, use LLDP, trust DSCP for QoS

Tag another VLAN for additional guest wireless network going to UniFi AP's (for TV to be separate from office/default LAN)

Use priority queue on ER-X to QoS DSCP 26/46 going out WAN port

Use ER-X as "router on a stick", eth0 is WAN, eth1 is default VLAN1, eth2 VLAN 10 for voice, eth3 VLAN 20 for guest wireless, etc.



Just did the above (with the addition of a dedicated voice circuit from the ISP) on a larger scale using multiple ES24 switches, fibre backbone, 20+ phones, 20+ PC's, 3 UniFi AC LR, 16 IP cameras. Works well.
 
Mal1ce said:
Get a managed switch, Edgeswitch 8 or 16 PoE works well:

Put PC's/printers/UniFi on default VLAN 1

Put Yealink device on voice VLAN, use LLDP, trust DSCP for QoS

Tag another VLAN for additional guest wireless network going to UniFi AP's (for TV to be separate from office/default LAN)

Use priority queue on ER-X to QoS DSCP 26/46 going out WAN port

Use ER-X as "router on a stick", eth0 is WAN, eth1 is default VLAN1, eth2 VLAN 10 for voice, eth3 VLAN 20 for guest wireless, etc.



Just did the above (with the addition of a dedicated voice circuit from the ISP) on a larger scale using multiple ES24 switches, fibre backbone, 20+ phones, 20+ PC's, 3 UniFi AC LR, 16 IP cameras. Works well.
Click to expand...
Thanks. I initially planned to purchase Unify US-8-60W switch, but your recommendation for Edgeswitch range gave me a thought for more research. It turns out that Unify switches can't do QoS. Not sure whether they even do L2 traffic prioritisation based on a VLAN tag, it is not clear. So I am looking for a better switch (desktop size).

You are right pointing out that VoIP needs a preferential threatment, not sure whether with a single VoIP base station I need a full blown L3 QoS. Maybe simply a physical port prioritisation on the switch/router-on-the-stick would be sufficient. A step above is a L2 tagged Voice VLAN priority, but I don't see anything in the EdgeOS manual to cover these cases. Please advise. If not possible on ER-X, then I would re-take on Mikrotik hEX RB750Gr3 router instead.

I would like to avoid a full-blown L3 QoS setup on ER-X, as it will disable all hardware off-load benefits.
 
Last edited:
If you want QoS on the ER-X then unfortunately hardware offloading has to go. Takes routed throughput to around 300mbit/s instead of 950mbit.

Edgemax switches over UniFi switches at this point, until Ubiquiti allow more features/control of the UniFi switches via the controller.

Edgemax switches offer a voice VLAN, takes 2 minutes to configure using CLI. Forget trying the OUI based or auto voice setup - never worked for me, I went the LLDP route.

I prefer Edgemax priority queue to MikroTik queues, MikroTik will only act when the pipe is full, whereas Edgemax will get voice packets out first regardless.
 
Cisco

sajunky said:
I would like to avoid a full-blown L3 QoS setup on ER-X, as it will disable all hardware off-load benefits.
Click to expand...
I know not in your original spec for equipment in your first post.
but
Have you considered CISCO
Why not do yourself a favour and have a look on GUMTREE then do some sums comparing cost to features
Assuming this is not for a corporate and you do not need official Vendor backup.
There are really good honest bargains.
YES
You can even configure it with a GUI ( no Linux "rash" :crylaugh: )
 
MidnightWizard said:
Have you considered CISCO
Why not do yourself a favour and have a look on GUMTREE then do some sums comparing cost to features
Assuming this is not for a corporate and you do not need official Vendor backup.
Click to expand...
A size matters, rack mounted stuff do not fit in the wall cabinet.
MidnightWizard said:
There are really good honest bargains.
YES
You can even configure it with a GUI ( no Linux "rash" :crylaugh: )
Click to expand...
:) Only for Linux-style manuals, not a command-line interface. Can't read all over again the same things in various places.
 
Preparing on getting for this project a small 8-port Gigabit switch with basic L2 smart managed features (VLAN, QoS). What do you think about TP-Link TL-SG108E?
It is a new product officially not yet in SA, but is getting good reviews.
 
Last edited:
infscrtyrisk said:
Yet you connect to the Internet, and allow inbound voice?
Click to expand...
Perimeter network/firewalling is a term is used by network professionals when deploying on the company site externally accessible servers like WEB, mail, ftp or VoIP, it is why I misunderstood your question. See more: https://en.wikipedia.org/wiki/DMZ_(computing)

In this case we are not running servers on our network, but we do connect to the external SIP servers. It is a TCP connection initiated from our side, so our routers do follow a procedure typical for such type of of services. We don't even need to open UDP port 5060 port on the router for the incoming SIP traffic (while it is advised to do so), as usually it is done automatically for this specific IP address and incoming ports stay open as long TCP connection is active. The same procedure follow ISP routers. As for example, we don't have to apply for unrestricted APN on the cellular connections if we run on our site a SIP client, remember that.

To answer you question, it will be a typical firewall. We will open UDP port 5060 for the external IP address of the specific SIP server, thats all. I placed a SIP base station on a separate VLAN solely for the purpose that I thought it would help to prioritise SIP traffic. But the Ethernet switch I have just ordered can also do traffic prioritisation based on the Ethernet port (a physical RJ45 socket). Still not decided on the option, reading manuals.
 
Last edited:
sajunky said:
Perimeter network/firewalling is a term is used by network professionals when deploying on the company site externally accessible servers like WEB, mail, ftp or VoIP, it is why I misunderstood your question. See more: https://en.wikipedia.org/wiki/DMZ_(computing)

In this case we are not running servers on our network, but we do connect to the external SIP servers. It is a TCP connection initiated from our side, so our routers do follow a procedure typical for such type of of services. We don't even need to open UDP port 5060 port on the router for the incoming SIP traffic (while it is advised to do so), as usually it is done automatically for this specific IP address and incoming ports stay open as long TCP connection is active. The same procedure follow ISP routers. As for example, we don't have to apply for unrestricted APN on the cellular connections if we run on our site a SIP client, remember that.

To answer you question, it will be a typical firewall. We will open UDP port 5060 for the external IP address of the specific SIP server, thats all. I placed a SIP base station on a separate VLAN solely for the purpose that I thought it would help to prioritise SIP traffic. But the Ethernet switch I have just ordered can also do traffic prioritisation based on the Ethernet port (a physical RJ45 socket). Still not decided on the option, reading manuals.
Click to expand...

:-) No matter how you define it, it's a perimeter (basically connecting to or accepting connections from anything that you do not manage, and therefore untrusted). If you connect to a public network (even if you think that it's only outbound connections ), you have a perimeter, and need to control it.

So, what firewall are you proposing to use?
 
Well, after all this firewall related distraction, we can go back to the network planning.

The EdgeRouter ER-X should arrive next week (Uniterm Direct stock was depleted before I managed to make an order). All cabling is now completed, we have even more outlets in bedrooms, so we can directly progress to the final project with a separate switch.

TP-Link 8-port JetStream Easy Smart switch TL-SG108E has been ordered online R680, it arrived next morning from Tarsus (fast and free shipment). It is a small device that comfortable fit in the small wall cabinet together with a fiber box and ER-X. It can do all these 802.1q VLAN tagging, it can also trunk these VLANs (i.e. two VLANs from Ubiquity AP's to the ER-X, maintaining LAN separation for guest WiFi).

With regard to the advice given above, I will set separate 3 VLANs:
- Office (computers/printers, Unifi APs)
- Guest (some Ethernet outlets and quest WiFi on the Unifi APs)
- Voice (Yealink W52P base station)

TL-SG108E can prioritise VLAN traffic. In the datasheet it says "Support Port-based/802.1p/DSCP priority" (3 ways).

As I am going to prioritise Voice traffic by DSCP as adviced, it important to do it on the router, but it doesn't hurt to do the same on the switch - both, right?

Controlling Voice traffic is important, the other things might come later and these are not so important. It is a Sunday afternoon and I thought-out something else:

- keep VoIP station connected directly to ER-X. It will do Voice QoS priority DSCP queue on the router, but nothing more: offload any other (less important) traffic shaping from the router, give it to the SG108E. It should save many ER-X CPU cycles - right or wrong?

- move all office and two Unifi APs plugs to the SG108E. It will be only two VLANs on the switch. If any traffic shaping is needed in future, it will be done here, not on the router.
 
Last edited:
Generally, if you don't trust DSCP (or CoS, dot1q, etc) on the switch, the switch won't honour the DSCP tags and will remark incoming traffic with whatever the default DSCP value is for that port. So the traffic will get to the ER-X without the DSCP values of 46/26 unless you trust the values the device (phone in this case) is marking traffic with.

I prefer to trust CoS or DSCP so I don't prioritise the port or VLAN, just the SIP and RTP traffic.

Doubt that switch has the ability to police traffic and drop if it exceeds a threshold ala Cisco/Juniper/etc - so no "shaping" ability. Shouldn't need to shape internal LAN traffic either, just manage traffic destined for the internet - which should happen on the ER-X.
 
Mal1ce said:
Generally, if you don't trust DSCP (or CoS, dot1q, etc) on the switch, the switch won't honour the DSCP tags and will remark incoming traffic with whatever the default DSCP value is for that port. So the traffic will get to the ER-X without the DSCP values of 46/26 unless you trust the values the device (phone in this case) is marking traffic with.

I prefer to trust CoS or DSCP so I don't prioritise the port or VLAN, just the SIP and RTP traffic.
Click to expand...
Yes, everything makes sense and I have already decided to setup 802.1p or DSCP QoS for the VoIP base station. W52P appears to support both tagging methods and LLDP-MED as well. One of a reason I do connect W52P directly to ER-X is that LLDP is not available on SG108E, so I may lose some automatic configuration(?) possibilities, discovery/VLAN detection when connecting W52P to the SG108E.

As for the "Trust DSCP" option, it is only available on ER-X. SG108E do it in a much simplified way. It has three exclusive modes of QoS operation. Port Based, 802.1p and DSCP. It has 4 internal priority queues. When operating in 802.1p mode, TP-Link will map ingress packets with 802.1p tags to the one of these queues. The same when operating in DSCP mode, but this time it will look at 802.1q DSCP tags instead (in layer 3).

It looks like 802.1p and DSCP values are always preserved as long as the egress port is marked as a "tagged" on the VLAN configuration page. Otherwise VLAN tags are dropped when leaving such a port. Only untagged ingress packets receive VLAN default values for that PVLAN# and default priority tags. Manual do not say what are these values and how to change it, but as W52P can generate VLAN tags, I have nothing to worry about.
Mal1ce said:
Doubt that switch has the ability to police traffic and drop if it exceeds a threshold ala Cisco/Juniper/etc - so no "shaping" ability. Shouldn't need to shape internal LAN traffic either, just manage traffic destined for the internet - which should happen on the ER-X.
Click to expand...
It does, perhaps not in Cisco terms. It is very basic, you can only define ingress and egress maximum rate on the each port independently. I think it will be sufficient in the multimedia oriented environment.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X