Network VLans & Switches Consultancy/Advice

[talksr]

Hi there,

 

I have been working with a school in London for quite some time. They have about 4 48 port layer 3 managed HP Switches and then several 24 and 8 port HP managed switches.

 

They currently don't use Vlans but have two physical networks running on the site. They are due to get a new managed wireless solution from Fortinet and I am keen to get their network up to scratch before hand.

 

Can anyone recommend a company or business in the London area I may be able to get in for some consultancy and advice?

I am not sure if it would be more cost effective to remove the switches they currently have (which are about 6 years old) and buy a proper stack and then set up Vlans.

 

Just not too sure on how to proceed as not worked with a school of this size, usually only work at smaller primaries.

If anyone who works at a larger primary/secondary has any advice, I would be keen to hear from you. Seems sensible to me to utilise the current switches and get some Vlans running, maybe one for the wireless, curriculum and management, Paxton Access (one for VOIP for future) etc.

 

Any help would be greatly appreciated.

Edited January 6, 2017 by talksr

[Davit2005]

Hi there,

 

I have been working with a school in London for quite some time. They have about 4 48 port layer 3 managed HP Switches and then several 24 and 8 port HP managed switches.

 

They currently don't use Vlans but have two physical networks running on the site. They are due to get a new managed wireless solution from Fortinet and I am keen to get their network up to scratch before hand.

 

Can anyone recommend a company or business in the London area I may be able to get in for some consultancy and advice?

I am not sure if it would be more cost effective to remove the switches they currently have (which are about 6 years old) and buy a proper stack and then set up Vlans.

 

Just not too sure on how to proceed as not worked with a school of this size, usually only work at smaller primaries.

If anyone who works at a larger primary/secondary has any advice, I would be keen to hear from you. Seems sensible to me to utilise the current switches and get some Vlans running, maybe one for the wireless, curriculum and management, Paxton Access (one for VOIP for future) etc.

 

Any help would be greatly appreciated.

 

Good experience with CSE in the past, not London based but do cover the south east area.

 

No ties with them but they have been involved with a few projects at my previous employments and seem very professional and good at what they do.

 

https://www.cse-net.co.uk/

Edited January 6, 2017 by Davit2005

[foofighterjim]

I can recommend the good folk at The Switch Shop: networking, wireless, ip telephony & security specialists - Switchshop Ltd - if you are attending they will be at BETT.

[gh5000]

Maybe so you have a bit of knowledge before engaging a consulting firm you could post up your current switch layout (ie Visio diagram) and the model numbers of what you've currently got so we could give you some pointers and things to ask the consultants about. From my experience of being in your situation proper knowledge of what ports are connected to what devices, ie knowing your printer is on port 15 of switch 2 so that it can be properly untagged on the printer vlan is an essential part to the planning. And with school budgets as they are if your switches are capable of VLANing then use them. Then once you've proven the VLANing works upgrade your switches (unless of course you need upgrades to POE as part of the wireless rollout).

 

As a London school are you an LGfL school? And if not are you restricted by your ISP as to which internal IP addresses are used (eg for filtering)?

 

And more out of curiosity are you buying the recently bought by Fortinet Meru kit or original Fortinet wireless? The Meru stuff can use tunneled vLans so only the controller has to be tagged rather than every single AP.

Edited January 6, 2017 by gh5000

[talksr]

Maybe so you have a bit of knowledge before engaging a consulting firm you could post up your current switch layout (ie Visio diagram) and the model numbers of what you've currently got so we could give you some pointers and things to ask the consultants about. From my experience of being in your situation proper knowledge of what ports are connected to what devices, ie knowing your printer is on port 15 of switch 2 so that it can be properly untagged on the printer vlan is an essential part to the planning. And with school budgets as they are if your switches are capable of VLANing then use them. Then once you've proven the VLANing works upgrade your switches (unless of course you need upgrades to POE as part of the wireless rollout).

 

As a London school are you an LGfL school? And if not are you restricted by your ISP as to which internal IP addresses are used (eg for filtering)?

 

And more out of curiosity are you buying the recently bought by Fortinet Meru kit or original Fortinet wireless? The Meru stuff can use tunneled vLans so only the controller has to be tagged rather than every single AP.

 

Very sensible suggestion. We are LGfL. Couple of notes:

We currently have a 24 port managed POE switch, the new wireless solution will have 26 APs which will mean we will need a larger POE switch. We went with the wifi solution as they offered us a very good price in exchange for our old hardware. We have always really struggled with poor wifi signal and when fortinet came in, we were very impressed with the signal range they were able to achieve in comparison with Meru.

 

I have been really keen to get everything down on Visio for a while now, but I have had real trouble getting the right stencils. I have sourced the nearest to the real ones I could and put something together as attached. It is far from perfect, and doesn't have anything about printers, but gives a good idea of the current network topology.

 

Basically, at the moment, there are two networks in the school. An admin one (office staff computers, office printers, CCTV boxes, premises manager and Paxton Access Security Control Doors) and a curriculum one (class computers, ICT suite, Juniper managed wifi, all other school printers, display screens).

 

We have a number of servers, all with multiple NICs. There are two smaller 10 port switches, one for admin one for curriculum. These deal with all of the iLO connections for the respective servers along with a NIC connection for each. Each server is connected to both the admin and curriculum NIC which allows some printers to be shared across both NICs (someone like a class based deputy, could print to her office (admin) printer from her class.

 

Current servers are as follows:

HP ML350 G9 - Curriculum Server

HP ML350 G5 - Admin Server

HP Proliant DL320e Gen 8 V2 - soon to be replacement Admin Server running Server 2016 DC with virtualisation enabled.

HP ML350 G6 - VMWare VSphere server running 1 x Server 2012 for WSUS and Sophos EC 1 x Windows 10 testing image and 1 x Windows 10 to run the Paxton Access Data Server Service for admin connected computers.

HP Storageworks X1600 G2 Network Storage System for shared admin and curriculum files and onsite backups.

 

 

I anticipate that the school will move to VIOP telephony in the near future and with the new wifi solution, we are going to need to implement Vlans to get the best use out of it as at present, the wireless solution will only work with curriculum systems.

 

I had to zip the Visio file as it would not allow me to upload otherwise.

 

NetworkLayout.zip

Edited January 9, 2017 by talksr

[MS2011]

Hi talksr,

 

As you are LGfL school, do you use your own internal IP for filtering or are you restricted by your ISP ? Do you use LGFL USO account and filtering system?

[talksr]

Hi talksr,

 

As you are LGfL school, do you use your own internal IP for filtering or are you restricted by your ISP ? Do you use LGFL USO account and filtering system?

 

Hi, we make use of the built in LGFL filtering (we have an Cisco LGFL firewall on site) and we have two sets of internal IP ranges one for admin: 10.232.162.0 and one for curriculum: 10.232.164.0.

[coldhand]

I'd suggest you talk to Steve Wilde from 64Teq, service company specialising in education sector and can help you from procurement to implementation and project management.

 

PS - pricing from 64Teq has always been exceptional for us. We get at least half a dozen quotes from various suppliers and push hard for discounts but 64Teq always comes out top.

[gh5000]

Hi, it's kicked off a bit here so struggling to find time for a comprehensive response.

 

two sets of internal IP ranges one for admin: 10.232.162.0 and one for curriculum: 10.232.164.0.

What subnets are these on? Roughly how many devices on each range?

 

(This paragraph could be wrong but..)Looking briefly at your switch models they are all only layer 2. You need at least one layer 3 switch at your core to act as a router between your switches. Are these switches all located centrally?

 

The LGfL need to be aware of every subnet on your network that you want internet access through.

 

My first basic idea would be

1. Get your new POE switch, layer 3 capable and use it as the core switch.

2. VLAN your curric as (for example) VLAN100, admin as VLAN200

3. Get a new stub network on VLAN300 from the LGfL to service your school owned WIFI clients

4. Get a further stub network on VLAN400 for guest wifi if that's useful.

5. Do away with your 2 8 port switches(or use them as some sort of storage array only link for failover etc).

6. Your new core switch will be able to be configured with ACL to not allow traffic from VLAN300 to Admin, VLAN400 only to internet etc.

 

This would be a good start. Further tasks could be vlans for printers - these don't necessarily need internet access so could be done without begging the LGfL for new subnets.

[talksr]

Hi, it's kicked off a bit here so struggling to find time for a comprehensive response.

 

 

What subnets are these on? Roughly how many devices on each range?

 

(This paragraph could be wrong but..)Looking briefly at your switch models they are all only layer 2. You need at least one layer 3 switch at your core to act as a router between your switches. Are these switches all located centrally?

 

The LGfL need to be aware of every subnet on your network that you want internet access through.

 

My first basic idea would be

1. Get your new POE switch, layer 3 capable and use it as the core switch.

2. VLAN your curric as (for example) VLAN100, admin as VLAN200

3. Get a new stub network on VLAN300 from the LGfL to service your school owned WIFI clients

4. Get a further stub network on VLAN400 for guest wifi if that's useful.

5. Do away with your 2 8 port switches(or use them as some sort of storage array only link for failover etc).

6. Your new core switch will be able to be configured with ACL to not allow traffic from VLAN300 to Admin, VLAN400 only to internet etc.

 

This would be a good start. Further tasks could be vlans for printers - these don't necessarily need internet access so could be done without begging the LGfL for new subnets.

 

Right ok. That's a pain, I thought they were L3. The newest 48 port is slightly different. It is an HP 2530-48G. Have just checked, but that is also a L2. What type of layer three do you think I would need? Layer 3 Lite, Dynamic or Advanced?

I get what you mean by getting one L3 and running it as a core, but what does this do for redundancy? Presumably I would be better off replacing all of the other switches with L3 models as and when the time is right?

Currently all switches are located in a shiny new rack, with cat 6 (I believe) running to each computer/printer/other device. Wiring is all fresh and new.

 

I have no understanding of stub networks, so I am going to have to try and get my head around that.

In terms of your suggestion for the VLans, would you be suggesting that the admin network would also take the Paxton traffic (the network interfaces that connect to the mag lock doors around the site)? Just trying to get my head around the configuration work involved.

 

Thanks so much for your help, really useful. I don't want to waste funds on this site, but want it to be future-proofed and as well set ups as is possible. Had been looking at maybe getting rid of all of the switches and getting some Cisco or a proper stack, but don't think there would be the funds for that.

Edited January 13, 2017 by talksr

[Davit2005]

You would only generally need layer 3 at the core where you are doing routing.

 

As far as redundancy goes, how much you want to provide is limited by cost/need. Multiple core switches with redundant up-links from edge switches, firewalls in HA setup, multiple ISP connections all possible if the wallet is big enough.

 

As far as Cisco goes I would stick with HP if you want to buy new kit. I'd love Cisco but ongoing support costs are high not saying the kit isn't very good or will break down but you cannot knock the warranty with HP kit.

[talksr]

You would only generally need layer 3 at the core where you are doing routing.

 

As far as redundancy goes, how much you want to provide is limited by cost/need. Multiple core switches with redundant up-links from edge switches, firewalls in HA setup, multiple ISP connections all possible if the wallet is big enough.

 

As far as Cisco goes I would stick with HP if you want to buy new kit. I'd love Cisco but ongoing support costs are high not saying the kit isn't very good or will break down but you cannot knock the warranty with HP kit.

 

Thanks. Agreed, warranty is second to none. Had a 24 POE recently, around 7 y/o. Fan stopped working. Got a replacement one within a day. I think the warranty is life time. Pretty good if you ask me.

 

Only suggested as many years ago, I did CCNA so am far more familiar with the iOS commands than the HP ones. Most are similar, but you don't seem to be able to get away with the shortcut phrases in terminal.

[Davit2005]

Done CCNA too :-) .

 

The HP does have shortened versions i.e. for show vlans

sh vl

,show connected lldp devices

sh ll i r

. also the ability to add a port to a vlan such as

vlan 2 untagged 13

direct from the config prompt rather than needing to go into individual interfaces or even disable a port with

int 13 disable

.

 

There does seem to be discrepancies between firmware though of what you can do in certain prompts.

Edited January 13, 2017 by Davit2005

[talksr]

Done CCNA too :-) .

 

The HP does have shortened versions i.e. for show vlans ,show connected lldp devices . also the ability to add a port to a vlan such as direct from the config prompt rather than needing to go into individual interfaces or even disable a port with .

 

There does seem to be discrepancies between firmware though of what you can do in certain prompts.

 

 

Yes, that's true. It is a case of trying to remember them all! HP warranty on switches is the best I have ever know which is a strong deciding point.

 

Would something like this be suitable as a core switch?

 

Aruba 2930F 48G PoE+ 4SFP+ - switch - 48 ports - Managed - rack-mountable - King of Servers