simonm

You haven't got a duplicate IP address have you ?.. that can cause intermittent connection issues ( to say the least)

The other thing about the small / soho switches is that often they are NOT managed, so that means you can't deploy Vlans, Spanning Tree etc. Also when they are hidden ( which they often are ) it can make troubleshooting quite interesting.

When you're doing routing / L3 switching ( just think of them as the same for this conversation), then if you want to get further than the local subnet, then each subnet needs a gateway address whether physical or virtual. On a L3 switched network this will be a Vlan with an IP address associated with it. For a router or firewall it will mostprobably be a physical interface. What a device does is this .. it looks at it's own IP address and subnet mask to determine what it's network address is, if the destination network is different then it sends the packet to the next hop in it's routing table, or failing that the default gateway ( 0.0.0.0 / 0.0.0.0 ) That IP address is the default gateway, or next hop for the devices on that particular network / subnet. The way that devices get told about that IP address is either by DHCP, or manually ( hard coded gateway). On a network with lots of subnets then you might need a combination of a default gateway and static or dynamic routes. the default gateway tells you where to go if you don't have an explicit routing entry about how to get a particular subnet. As long as your default gateway knows how to get everywhere then you're fine, otherwise you might need some other routing entries.

I would put a dedicated computer with minimal software on it as the ping responder, and try to ping that. At the end of the day if whatever you're pinging is stressed, then it might not respond ( as a priority compared to other stuff ). At the same time as pinging the computer you could monitor the network with the likes of wireshark, as suggested. rgds Simon

When you're doing L3, the Vlans on the switches doing the routing DO have IP addresses ( think of them as virtual interfaces ) which is not only potentially for management but for the routing of data as well ( the default gateway for devices on it's IP range). Remember not all switches do L3, and typically you will only be doing L3 routing in the core of your network. You don't have to use the switch to do routing, you could use say a host with more than 1 NIC in it, however you'll typically get faster performance out of a good L3 switch. Other key thing to remember is with IP routing not only do you need a route out to wherever you want to go, you need a route back as well. Sometimes you can't do this just with a default gateway, you might need to put static routing entries in server / firewalls etc. Different switches have different mechanisms for setting up these IP addresses.

Hi, sorry for delay in responding, been out and about. If you run a wireshark capture for 10 minutes during a typical first thing logon period ( might not be representative now if most people have packed up for the summer hols ) , and say in the middle of the day then that will just capture packets from your PC and the rest will be broadcasts, so no need to set up port mirroring. If you then just look at the total number of broadcasts AND multicasts ideally excluding any traffic from your PC then you should see an average kb/s or mb/s speed, thats what you're interested in.

Whatever you do, it's worth thinking about redundancy - so if you just have one core switch and that fails then life becomes interesting until the replacement comes. If you can look at a design which gives you some resilience or fallback ( even it's taking gbics out of a failed core switch and plugging into something else ). This PDF from HP can be quite useful as they have so many products http://h20195.www2.hp.com/V2/GetPDF.aspx/4AA1-7037ENW.pdf

I presume and IPCONFIG on the client shows the new default IP address. Does a ROUTE PRINT command show anything that contradicts this ?

Going from flat to VLANs and L3 routing is something you'd want to plan, and if you haven't done before take some advice, and certainly do some tests first. The other guys have commented that you need at least one switch ( with decent horsepower ) to route between vlans IF required. Also, you'd need to look at your DHCP and IP addressing, and work out how you're going to allocate the IP's to the new VLANs ( typically multiple DHCP scopes). Just out of interest have you run wireshark yet to see the kind of broadcast rate you typically run at ? - it may be that you don't see any huge performance benefit by going to multiple VLANs, but there are good reasons to consider it, like I said. Some people go OTT on VLANs, so there is a balance to be drawn.

Hi, not sure about the Sophos, but for sure you can load balance with the like of a Watchguard UTM firewall. I don't think you'll get true bonding without kit that the internet line provider supports, as it would need something at both ends typically. As long as you've got plenty of users then load balancing or some kind of policy based routing should split the traffic across the lines.

Just out of interest does it do this with all encryption methods .. have you tried changing encryption options on the PC/AP and seeing if that makes a difference ?

Might be worth just trying the qnap with one network cable connected, and into a different port on the switch - so go configure another port to vlan 500 - just to see if trunking is contributing to the issue. As one of the other posters said, get 2 laptops in vlan 500 talking to each other on the same ports first so you know the ports are fine.

Hi, a useful test to do might be to run Wireshark and see how many broadcasts you have as a percentage of overall network capacity - because a vlan would help to contain the broadcasts fi they are high. Also, if you have a wireless network then there are advantages to having vlans as keeping unecessary broadcasts off that is a good idea because of the much slower speed ( typically ) of the wireless nework. From a security perspective it might also be good to have the access control and CCTV vlanned off the main network. rgds Simon