MAT Network Layout thoughts

[nathan]

Hi All,

 

I'm just pondering on some thoughts for a primary MAT network layout whilst trying to cut down on some Microsoft License costs. I'll keep updating this post with more information as i get it. My thoughts so far are;

 

Centrally Hosted at Azure

-Finance System (PS Financials)

-Zabbix Monitoring (To monitor servers, switches, routers etc)

-Backups

-Azure AD Domain Services (https://azure.microsoft.com/en-gb/services/active-directory-ds/)

-Wireless Controller (Unifi)

-Elastix Phone System (possible with SIP trunks from Spitfire)

 

Each School/Node

-Linux Server

-Currently 80/20mb EoFTTC, moving to 100mb leased in the short/mid future

-File Storage

-Domain Controller replicating with Azure ADDS

-Print Server

-DHCP

-RDS Linux Based Alternative

-Backups to Azure hosted backup storage/Backups to another school

 

Networking

-Each School/Node will have VLANs (WIFI, Guest WIFI, Printing etc)

-VPN at the router level (Still unsure on this)

 

-Are there any glaring issues this would present?

-Perhaps other ways to reduce the cost too?

-I haven't found anything yet in the research I've done but has anyone found information on bandwidth of AD replication?

Edited March 21, 2016 by nathan

[snagrat]

I'm interested how you get on with functionality and pricing for the hosted ADDS and a DC in each school.

[nathan]

I'm interested how you get on with functionality and pricing for the hosted ADDS and a DC in each school.

 

I haven't had time to investigate it much more, but it certainly looks interesting. https://azure.microsoft.com/en-gb/services/active-directory-ds/

[nathan]

Something else to consider is the bandwidth used for replication of the AD, and should i decrease the replication schedule duration to 15/30 minutes?

[Steve21]

What licensing costs are you trying to reduce by this? From the above layout all you're really removing is one or two server licenses at each place, but everything else in regards to Windows/Office/CALs etc are all going to be in place so seems like a lot of hassle for such a few savings.

 

As an example:

 

Backups to Azure hosted backup storage

 

Why increase your costs to store this in the cloud if you have multiple sites you could backup between for free?

 

Steve

[nathan]

What licensing costs are you trying to reduce by this? From the above layout all you're really removing is one or two server licenses at each place, but everything else in regards to Windows/Office/CALs etc are all going to be in place so seems like a lot of hassle for such a few savings.

 

As an example:

 

 

 

Why increase your costs to store this in the cloud if you have multiple sites you could backup between for free?

 

Steve

 

Some good points,

 

By my calculations i would only need Windows and Office licenses, where would i need CALs for as all clients would be accessing the Linux server. Or is what i'm saying is incorrect?

 

Certainly a good option for the backups which would reduce costs.

Edited March 21, 2016 by nathan

[Steve21]

If you're connecting to a Windows Machine even on a Linux Server RDS wise you'll need CALs etc, as would you if you're connecting to any Windows servers for anything DHCP etc.

 

As an example -

 

-Domain Controller replicating with Azure ADDS

 

If your clients are connecting to that DC and not Azure, then it's a CAL required etc etc

 

Or are you talking no Windows at all?

 

Steve

[nathan]

If you're connecting to a Windows Machine even on a Linux Server RDS wise you'll need CALs etc, as would you if you're connecting to any Windows servers for anything DHCP etc.

 

As an example -

 

 

 

If your clients are connecting to that DC and not Azure, then it's a CAL required etc etc

 

Or are you talking no Windows at all?

 

Steve

 

The idea (i still need to ensure it's technical possible) is;

 

There would be no Windows Servers in the school, Each Windows Client would connect to the Linux server that is replicating with Azure ADDS. It's that latter part that i still need to investigate as i'm not 100% it's technically possible.

[DGardiner]

we have a 200/200 Line coming in on a gig bearer to the head office then 100mb links to each school - we then share the main broadband line/filtering and have full internal connectivity and this has worked well for the last 5-6 years 3 of the schools are on one domain one is on its own as we only recently got their point to point link installed.

 

this has allowed us to pickup a higher spec main line than any of the schools could individually really afford as well as a decent saving from sharing the UTM.

[nathan]

we have a 200/200 Line coming in on a gig bearer to the head office then 100mb links to each school - we then share the main broadband line/filtering and have full internal connectivity and this has worked well for the last 5-6 years 3 of the schools are on one domain one is on its own as we only recently got their point to point link installed.

 

this has allowed us to pickup a higher spec main line than any of the schools could individually really afford as well as a decent saving from sharing the UTM.

 

Thanks for sharing, what has the broadcast traffic been like and do you have any servers at each school or all hosted at the head office?

Edited March 21, 2016 by nathan

[cpjitservices]

You could possibly use PRTG for network monitoring, I love Zabbix dont get me wrong but PRTG is alot easier to setup and talk monitors a lot more.

[DGardiner]

Thanks for sharing, what has the broadcast traffic been like and do you have any servers at each school or all hosted at the head office?

 

Its been fine honestly the only traffic issues we have had is being a bit too ambitious with the DFRS schedules, we grew organically so what worked with 2 sites didn't scale too well as we grew

 

we have an onsite fileserver/dc at each school and replicate all data between all servers and use DFRS namespaces to be able to point to another building in the event of a server dying. this allows us to do data backups on one machine and backup everything more often

[nathan]

You could possibly use PRTG for network monitoring, I love Zabbix dont get me wrong but PRTG is alot easier to setup and talk monitors a lot more.

 

it doesn't look like its free though if you have more than 100 sensors. Zabbix is completely free which is why i learnt to use it, but you are right - getting it up and running is a bit of a pain.

[PotNoodleTech]

Even if you are using Azure AD in the cloud, you would still require a Windows device CAL for each PC wouldn't you as you are still connecting to windows server, albeit via the internet. Given that I spend £600/year for 2xdatacentre licences with unlimited virtual hosts, I really can't help but wonder what kind of cost savings you're actually going to achieve by doing all of the above?

[Steve21]

Even if you are using Azure AD in the cloud, you would still require a Windows device CAL for each PC wouldn't you as you are still connecting to windows server, albeit via the internet. Given that I spend £600/year for 2xdatacentre licences with unlimited virtual hosts, I really can't help but wonder what kind of cost savings you're actually going to achieve by doing all of the above?

 

Azure servers contain the CAL pricing within the subscription cost (Not if it's a local server replicating though as that would be what clients connect to), but still think it's going to waste more money on "cloudness" than just a cheap local server license

 

Steve

[nathan]

Even if you are using Azure AD in the cloud, you would still require a Windows device CAL for each PC wouldn't you as you are still connecting to windows server, albeit via the internet. Given that I spend £600/year for 2xdatacentre licences with unlimited virtual hosts, I really can't help but wonder what kind of cost savings you're actually going to achieve by doing all of the above?

 

How many sites do you have though? a single site i agree, but if there were 10's of sites?

 

As i mentioned above, cost saving isn't the sole reason for this.

[PotNoodleTech]

How many sites do you have though? a single site i agree, but if there were 10's of sites?

 

As i mentioned above, cost saving isn't the sole reason for this.

 

Hi!

 

Only one for me, yes, but if it's multiple sites it's the same reasoning for me - you just have 2 x datacentre licences and 2 x physical servers in a main "MAT datacentre" and host all the servers there instead of azure/local hybrid. No requirement for on site Linux servers then either. I suppose as a MAT you do not get access to current EES licenceing as this makes a big difference IMHO to which solution to chose (e.g. I gave up a lovely ultra reliable VMware set up to move to EES/Windows).

 

I'm only trying to figure out why you would need to do this as for me when you take into account

a) cost of azure hosting/licence etc

b) cost of physical server(s) at each school for Linux/rds/print/etc

c) time taken to set all of the above up

 

I can't see where you will be gaining? Feel free to shoot me down if I have missed something obvious!

[nathan]

Hi!

 

Only one for me, yes, but if it's multiple sites it's the same reasoning for me - you just have 2 x datacentre licences and 2 x physical servers in a main "MAT datacentre" and host all the servers there instead of azure/local hybrid. No requirement for on site Linux servers then either. I suppose as a MAT you do not get access to current EES licenceing as this makes a big difference IMHO to which solution to chose (e.g. I gave up a lovely ultra reliable VMware set up to move to EES/Windows).

 

I'm only trying to figure out why you would need to do this as for me when you take into account

a) cost of azure hosting/licence etc

b) cost of physical server(s) at each school for Linux/rds/print/etc

c) time taken to set all of the above up

 

I can't see where you will be gaining? Feel free to shoot me down if I have missed something obvious!

 

We can still use EES, a few of our schools are currently in an EES agreement but i'll be doing something across the trust.

 

a) I'm kind of hoping this will be reduced in the future, i know nothing is confirmed yet but we can hope!

b) These wouldn't be low end servers so nothing to break the bank

c) It's going to take time either way i do it.