Ubiquiti Switches - Layer 2 and 3

[ITJS2015]

Hi

 

I am wondering if someone could point me in the correct direct of switches.

 

We are currently using netgear switches which have been in for a long time. We are currently working off s flat network with no vlans and for security measures i want to implement this on our network. We are looking at Ubquiti switches but i have been told it has to be layer 3 for a core switch and layer 2 for an edge switch.

 

We currently just have 3 netgear switches which are flat and one of them is poe which does our unifi APs and ideally i would want it better managed centrally.

 

If there is anyone using ubiquiti switches could you share some information in regards to what you have got or if someone could recommend what i would need.

 

Thanks

[localzuk]

I don't run any Ubiquiti L3 switches myself (we already had HP core switches in place), but I believe you'd be looking at the newer Pro range for L3 stuff. They've recently released their Enterprise range also which has L3 stuff too.

 

So something like a USW-Pro-48-PoE for the core, then USW-48 at the edge. If you're only looking at 3 switches. If you need more in terms of 10G ports (eg. if you have several servers you wish to connect at 10G) you could add a USW-Aggregation as well - so all your switches aggregate into that, and connect in to your core from it. Your servers could then use the spare SFP+ ports on the core.

 

You'd also need a controller. You could either run it as a VM if you have virtualised servers, or you could get a CloudKey2.

[Davit2005]

Hi

 

I am wondering if someone could point me in the correct direct of switches.

 

We are currently using netgear switches which have been in for a long time. We are currently working off s flat network with no vlans and for security measures i want to implement this on our network. We are looking at Ubquiti switches but i have been told it has to be layer 3 for a core switch and layer 2 for an edge switch.

 

We currently just have 3 netgear switches which are flat and one of them is poe which does our unifi APs and ideally i would want it better managed centrally.

 

If there is anyone using ubiquiti switches could you share some information in regards to what you have got or if someone could recommend what i would need.

 

Thanks

 

There is a similar thread here which is worth a read http://www.edugeek.net/forums/wired-networks/221672-ubiquiti-inter-vlan-routing-options.html

 

There is a review here by a YouTuber who does reviews and tech stuff

 

Just implementing vlans itself will give limited security but can be added to by ACLs etc to provide greater security. There are also some best practices that should be employed with vlanning such as preventing vlan hopping etc.

Edited May 19, 2021 by Davit2005

[ITJS2015]

Thanks for the reply

 

Currently we connect from a council switch off cat5 to one of the 3 switches and then use a cat5 uplink to the second switch and then from the second switch to 3 poe switch.

 

Ideally i want them fiber uplinks between the core and edge switch.

 

I only have 2 servers on site as we are only a primary school.

 

We run a dc and file server on one the other server is for image building and our AV .

 

The unifi software is one server but its not a hardware controller.

 

All i want on my core is my servers and unifi APs on the core and the desktops and printers on the edge switch. Does that seem basic / best way forward ?

 

Can you recommend ?

 

Thanks

[localzuk]

How do you want to connect your servers to the switches? Copper or fibre? What speed do you want to connect them at? 1Gbps or 10Gbps?

[ITJS2015]

How do you want to connect your servers to the switches? Copper or fibre? What speed do you want to connect them at? 1Gbps or 10Gbps?

 

We are connecting our severs to the switches via Cat6 cable but our NIC cards are only up to 1GB. Not sure if it will hold 10gb but i would have to check.

 

Do you think linking the core and the edge switch via fibre is the correct way or should i keep them separate ports on our council switch ?

[localzuk]

I would treat your council switch as a third party router - a black box if you will. I would handle all your own networking internally. So, yes, connecting all your switches together to your own core via fibre (or via direct attach cables if they're all in the same cabinet) is the way I'd do it.

 

I'd stick with the USW-Pro-48-PoE for the core, as you can connect your 2 edge switches to the SFP+ ports via fibre/direct attach, connect your servers via Cat6 and still have future expandability to upgrade the 2 servers to 10Gbps if you wanted, with 2 spare SFP+ ports.

[lattice-mike]

Hi,

 

Sorry - just seen this thread. I hope you don't mind if I comment - I am hoping to bring some enterprise experience to this forum if at all possible

 

Are you saying the switches are all daisy chained together at the moment - council switch <-> switch 1 <-> switch 2 <-> switch 3?

 

If that is the case then depending on your structured cabling setup, and the switch locations - I would also recommend a hub and spoke physical topology, to reduce the size of the failure domain. Also I would suggest etherchannel (bundling/portchannel/lag) a couple of uplinks to your core switch, per access-switch.

 

In terms of copper vs fibre - I would probably not bother with the expense of fibre in this scenario - it is not really beneficial unless the run length is over 100m or the cabling standard used/run length will not support 10Gbps.

 

Otherwise I would totally agree that you should be in charge of the routing, although it will be a fairly simple setup. Also - as previously mentioned configuring multiple vlans along offers no security benefits unless you have some sort of access-list on the L3 interface, or the L3 interface lives on a firewall.

 

When it comes to providing network services at the edge - it is usual to just use the core to plug other switches into, and not to present access-ports. This way each switch has a specific role - but ultimately in a deployment of this size, it won't matter that much.