Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Church/School Network Design & L3/L2 Switch Questions


  • Please log in to reply
2 replies to this topic

#1 t3hn4t3

t3hn4t3

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:23 PM

Posted 22 December 2015 - 12:40 AM

Hi guys, long time lurker and first-time poster. I will note that I'm somewhat familiar with the concepts I'm about to ask about but in no way an expert which is why I'm asking for advice. Please correct me where needed. I apologize for the length of the post.

 

I have been asked to overhaul the network for my church of about 200 people. I have a very limited budget to work within ($1000) and I am replacing existing (aging) hardware. I am at least fortunate that most of the wiring was recently redone with quality CAT5e during a recent renovation.

 

Existing Network: (note that all wireless routers mentioned are operating in AP mode, no DHCP, no routing)

 

- WAN/DSL modem --> cheap wireless router someone donated --> 10/100 Netgear Unmanaged 24-Port Switch.

 

- The 10/100 Netgear Unmanaged 24-Port Switch is located in the church office and has runs to several rooms within the church side including several cheap wireless routers (we're talking WRT54G's still in service). There's also about a 100 ft run to a detached building next to the church where another cheap wireless router is setup.

 

From this switch in the church office is a run to the school office which has a

 

- 10/100 Netgear Unmanaged 16-Port Switch with runs to two more cheap wireless routers and about 2 runs per school room.

 

Issues: If you couldn't guess already, throughput on the network is awful. I did not design the network and the person before me did a good job of managing the network but many people in the church "lent a hand" in helping and, as a result, the wireless situation is horrible as every SSID on the network is different. Most of the church has the password to access the network which drags down our Windstream 6mbps DSL connection to a crawl and users get kicked off because those residential WAPs were not designed for 100 people connecting to them on a Sunday morning. Also, the church wants to add WAPs across the network and we can't afford two PoE switches, so we would have to buy PoE injectors/adapters to connect WAPs to the network. Last, but not least, my budget is $1000.00 and that includes buying extra cable (non-CCA) to install the new WAPs.

 

Goals:

 - Unified network system so that pastors/staff as well as guests can roam around the building on the same network.

 - Separate the WiFi network for guest (internet only) & staff (complete network) access

 - Upgrade the current network to gigabit

 - Remove old hardware bogging down network

 - Add features such as a better firewall, internet filter, NAT, VPN and move DHCP to a separate process that doesn't require access to the main church server that's currently setting DHCP.

 - Upgrade internet access to 50/5 TWC Business Class & change phone provider to TWC (phone system I've taken care of already)

 

Plans:

 - $200 EdgeSwitch Lite 24-Port L2/L3 Managed Switch from Ubiquiti for church office

 - ~$150 ZyXEL 16-Port L2 Managed Switch for school office

 - $400 5 Pack of Unifi AC-Lite AP's (originally I had quoted 3 x AP-LR Wireless N units but I see that Ubiquiti just came out with these new Wireless AC AP's)

 - $75-$100 5 .5A 12W Gigabit PoE Injectors (see note above -- since 1 AC-Lite would be added to a detached building, 2 AC-Lites would be installed in one end of the building and 2 AC-Lites would be installed in the other end of the building plugged into the 16-port switch and we cannot afford 2-3 PoE switches, we would have to use the adapters from Ubiquiti. Not ideal but affordable at this point)
 - Current ESXi vm currently runs Windows Server 2012. Will be adding pfsense as Router, VPN, VLAN setup, DHCP and Firewall to virtual switch that connects to untangle (free) for internet filter and then out to the gigabit switch.

 

My current plan is to install the TWC modem and run it into eth0 on the ESXi server, to a virtualized instance of pfsense operating as a router, firewall, VPN server, DHCP server and VLAN controller with a private vlan tagged 10 and a public plan tagged 20. A virtual switch would then run to Untangle (free) to operate as internet filter. From there would run out of eth1 to the EdgeSwitch Lite. Many ports would be untagged 10 so the wired network to the offices could work as they currently do. 3 of the ports on the switch would be tagged 10 and 20 for VLAN trunking to the Unifi AP's. One of the ports would be tagged 10 and 20 for the run to the school office.

 

Here is where I have the issue and this presents my issue that I can't seem to find an answer for: Does the school office need a L3 compatible switch or can I use a cheaper L2 managed switch? The school office needs to be able to accept the trunked run from the EdgeSwitch Lite (tags 10 and 20) and send the trunked lines back out to two more Unifi AP's. The rest of the wired network would be untagged 10 as they need access to the private network at the school. 

 

Questions:

 - Can I get away with an L2 switch in the school office connected to the L3 switch in the church office and still have the trunked VLAN's? I would have the eventual goal of splitting the school and church networks into their own VLAN but allowing access between the VLANs to specific IP's like network printers, etc.

 - Will the Unifi AC-Lites be enough to handle 100 clients across 5 WAPs in a 600' long building?

 - What am I missing in my network plan?

 - Should pfsense be controlling the VLAN tagging?

 

Thanks for your help. I really appreciate it.

- Nate


Edited by t3hn4t3, 22 December 2015 - 12:40 AM.


BC AdBot (Login to Remove)

 


#2 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:07:23 PM

Posted 22 December 2015 - 11:00 AM

"Unified network system so that pastors/staff as well as guests can roam around the building on the same network"

 

You need equipment that supports WDS [not seeing support for this with the Unifi AC-Lite AP's] and has both private and public [guest] segmented wifi.

https://en.wikipedia.org/wiki/Wireless_distribution_system



#3 t3hn4t3

t3hn4t3
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:23 PM

Posted 22 December 2015 - 12:59 PM

"Unified network system so that pastors/staff as well as guests can roam around the building on the same network"

 

You need equipment that supports WDS [not seeing support for this with the Unifi AC-Lite AP's] and has both private and public [guest] segmented wifi.

https://en.wikipedia.org/wiki/Wireless_distribution_system

 

I was hoping to hear from you, Wand3r3r, as I've seen you active on other threads regarding similar issues :).

 

I guess I should edit that to say that they're looking for a single SSID where they don't have to keep manually disconnecting from one WAP to walk to the other end of the building to connect to another SSID broadcasting from a different WAP. The ability to roam the entire building without disconnecting/reconnecting to the wireless system and using a WDS is out of our price range. Typically they stay in one area of the building with their equipment (laptops/tablets). The only exception would be walking through the building with their smart phones.

 

Ubiquiti's Unifi AP's have their uplink capability but I've read that more than 3 has issues and I'd prefer to have all 5 of these hard wired.

 

Is this going to be an issue?


Edited by t3hn4t3, 22 December 2015 - 01:00 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users