Shared Internet

[NewBoy]

I am after a little advice please guys, I currently look after 2 schools on the same site (both average size primarys), we have only just taken over and they are in the process of having the internet upgraded to a fibre BT line. Now both schools will share the line and stay as 2 separate schools for the time being.

 

They are both getting new Zyxel gig switches and will be connected via a fibre link, so my question is whats the best way to connect them together so they can access the internet but keep their networks separate.

 

1. Both want to keep their data separate from each other (as to be expected)

2. Both are running DHCP and DNS and AD as they are separate sites

 

My first thought was to VLAN each switch and tag port 28 which is the Gbic for the fibre, is this the best route and what other configuration would need doing ??

 

Cheers in Advance.

Edited January 19, 2017 by NewBoy

[Willott]

Other query is router wise what's going in, it would ideally need 2 VLAN interfaces on it with 2 IPs - one relating to each network, then it's "internal" interface connected to a switch port configured as trunk, allowing both vlans, and have the port configured for fibre to be trunk allowing the VLAN for the school across the fibre link (done this way so in future can easily add further VLANs if you wish), same with port on other side of fibre link. Switch ports in each school then set as access with relevant default vlan assigned (I can never remember which way round tagging vs untagging goes - Huawei using default vlan so...)

[FN-GM]

What Firewall are you using?

 

To keep it simple I would have 2 separate zones, one for each school. Then assign a zone to 2 physically separate firewall ports and plug each network into the port. That way they are totally separate and not going through each others switches.

[Willott]

2 physically separate firewall ports and plug each network into the port. That way they are totally separate and not going through each others switches.

 

Transceivers from Fibre to 10/100/1000base-T I'm guessing would be the issue here, unless firewall/router has slots available.

[FN-GM]

Transceivers from Fibre to 10/100/1000base-T I'm guessing would be the issue here, unless firewall/router has slots available.

 

lots do these days. Sonicwalls for example do. Or you could use a small switch as a media converter.

[NewBoy]

What Firewall are you using?

 

To keep it simple I would have 2 separate zones, one for each school. Then assign a zone to 2 physically separate firewall ports and plug each network into the port. That way they are totally separate and not going through each others switches.

 

 

I believe that both sites will be having a Meraki firewall installed at the same time the fibre is done linking the sites, I have never had to do anything like this before so it's defiantly a new one on me :-)

[FN-GM]

So that have a firewall each?

 

In that case a simple switch that the BT lines plugs into and each school firewall.

[Oaktech]

We do this, and we literally just added a cable and took it straight to our router, which is a mikrotik, the networks don't touch. Our ISP handled the router config and filtering and we are sat behind their fortinet firewalls.

[NewBoy]

So that have a firewall each?

 

In that case a simple switch that the BT lines plugs into and each school firewall.

 

Yes both schools will have a Meraki firewall each so the theory is I can take a connection from the back of the firewall straight to the router and each school will have internet without seeing each other.

[LeMarchand]

We do this, and we literally just added a cable and took it straight to our router, which is a mikrotik, the networks don't touch. Our ISP handled the router config and filtering and we are sat behind their fortinet firewalls.

 

That's pretty much what happens at one of mine and another local school that I have visited.