Rolling out new network / office reno

B

Berg0

[H]ard|Gawd
Joined
May 16, 2005
Messages
1,038
Hello, little undecided where this should go (might eventualy belong in network gallery).

Over the next month I'll be rolling out a new network for a local business owner who is redeveloping an office building into a very interesting space. the building will house office space leased by small companies (about 24 offices total), have a coworking space (open concept office space for mobile professionals) and include a coffee shop. I will be leasing space in the basement as part of a locla non-profit organization I'm on the board for (a local hackerspace).

Figured i'd post some stuff I'm working on in here, as this is more of just a fun side project, I was willing to take it on mostly because i'll be leasing space, and would prefer for the network to not suck!

I'll likly be going with the following gear, but open to sugestions:

Cisoc ASA5505 w/ 50 user license
Cisco 2106 lightweight access point controller
5x Cisco 1131AP access points in lightweight mode (will use POE injectors for these)
HP 2848 GB L3 switch (2nd floor)
HP 2824 GB L3 switch (basement)

Demarc in in the basement, so some equipment will go there, bulk of the office space is on the 2nd floor, so 48 port switch goes up there. Main floor is mostly served by wireless, with exception of the shared xerox print center.

I'll be setting up a captive portal guest wireless access for the coffee shop, and a seperate WLAN for users who pay monthly memberships for the coworking spcace, or lease office space. The coworking/leaseholders will have internet access, and access to print to the xerox workcenter, provided they have a code.

Leased offics each have 2 network drops, and companies leasing more than a single office will have all offices on the same VLAN.

I'll post back later with exactly what I order, and welcome suggestions :)

Let me know if any of you have questions / comments / sugestions. i'm hoping this will be a fun little side project, as 99% of what i do now days is in the datacenter and haven't really done many small side jobs like this for a while.
 
Sounds like a pretty decent plan really. Your planning on putting ACLs on the vlans to only allow traffic from the office lease space.

Also are you dead set on the 5505? Have you looked at the lower end SRX series or anything else that might be a little more cost effective?

The only thing I might suggest is the printer on it's on shared vlan.
 
calvinj: that's exactly what I'm doing :)

I looked into using an SRX (quoted on it actually) but the ASA is cheaper (going through vology / network liquidators) I actualy have a pair of SRX240's I use, and about 8 SRX100's in branch offices. Also, i beleive I needed to go the SRX210H route so I could use it to controll the ax411 access points, and even then I'd need to buy another upgrade license because out of the box the 210 only suports 2 or 3 AP's or something? I'd need to look again.

Printer will be on it's own VLAN, ACLs on all VLANs so they get internet access, and access to the printer VLAN on correct ports, and nothing else. captive portal guest WLAN will gives guests access to internet only, no cross talk.
 
Last edited:
One thing I'd like to solicit feedback on in particular, is WAN link aggregation. I've looked into it in the past a bit, not not very much. to get a 3Mb EDI the ISP wants $1050/mon (ouch), but the building owner can get 25/3 ADSL for like, $80/mon, worried about the upload bandwidth on that service though. Any recomendations?
 
Id get two of those adsl circuits load -balance. Unfortunately, that asa5505 will only do wan fail-over so you'd need to look at a different firewall. Also, don't you think a 50-user license is a bit light? Id rather spend another hundge now than have to upgrade the license later when the user count grows
 
I don't think 25/3 would be too bad. I agree with Captain the 50 lic asa seems a little bit too close for what you'll want.
 
a few goodies showed up today, still waiting on a few more things.
photo-1.jpg
 
first, pics of gear being configured:
photo-2.jpg


So, got the gear installed late last night(installation pics to follow when I go back onsite), but ran into a few issues, maybe someone could give me some advice.

Have an ASA with a base license, so limited to 3 VLANs (inside, outside, DMZ) so my inter-vlan routing is handled by an L3 switch. i have a cisco access point controller.

So, I've got a VLAN, we'll say VLAN10. VLAN10 has some wired clients, and wireless clients, all need DHCP. WLC won't offer DHC addresses to wired clients, will only hand out addresses to wireless clients, and wireless clients get put on the apmanager vlan, so if I run DHCP on the ASA, the ASA received the DHCP discover, but won't DHCP offer because it's not coming from it's directly attached subnet. For now, jsut using a stand alone DHCP server, (spare laptop) but would prefer to not do so.

anyone have experience using a Cisco wireless controller for DHCP for both wired and wireless clients?
 
Does your L3 switch offer DHCP server capabilities? I know the Cisco 3550/3560/3750 ones do. If your APs weren't LWAPP they could do it, too. Not sure that the 2800 series ProCurves will do DHCP, couldn't really find anything on the tubes, just snooping...
 
Captain Colonoscopy said:
Does your L3 switch offer DHCP server capabilities? I know the Cisco 3550/3560/3750 ones do. If your APs weren't LWAPP they could do it, too. Not sure that the 2800 series ProCurves will do DHCP, couldn't really find anything on the tubes, just snooping...
Click to expand...

Just checked got that one here at home , and no no dhcp server like Cisco
 
Captain Colonoscopy said:
boo. how many VLANs are you doing here?
Click to expand...

correct, no DHCP server service on the procurve switches, boo indeed. I've got 4 VLANs right now, may be more later. it's a multi tennant environment, kicking myself for not speccing sec+ license.

initial scope of work was much smaller, they keep asking for things they didnt mention at the start, haha.
 
Do the HP ProCurve switches have an equivalent of ip helper-address?
 
cymon said:
Do the HP ProCurve switches have an equivalent of ip helper-address?
Click to expand...

yes, they do, but the ASA doesn't do a DHCP offer, but is receiving the DHCP discover. Problem (i think) is that the ASA only allows DHCP ranges to be created that are directly attached, so, in my case, only 1, and it seems to be ignoring the requests from other VLANs via the helper address. so, maybe not ackowleding unicast DHCP requests coming from the helper address? even if I go the ASA to work, I guess it doesn't entirly solve my issues, i wanted ot use the WLC, but it won't do DHCP for wired clients it seems.

blah
 
Yeah, the ASA will only do DHCP for directly connected VLANs. If you upped the license to Sec+ and got all your VLAN IPs on the ASA then that would solve your problem. You could also just buy a mini-PC, toss linux on it and run DHCP from that.
 
Captain Colonoscopy said:
just buy a mini-PC, toss linux on it and run DHCP from that.
Click to expand...

already configured and stitting on my desk, haha, I jsut grabbed a spare laptop and setup a dhcp server, will have to do for now, i"ll probabaly get them to pick up a itx rackmount pc of some sort.
 
I guess I'm just spoiled l'm just spoiled by Juniper gear at all my small offices lately, doing all that fancy stuff like more than 3 VLANs and acting as a DHCP server without addon licenses that cost as much as the hardware...
 
LOL, yeah, Cisco ASA is getting pretty gai these days. The 5505 a great little box but the moment you try to do anything beyond basic stuff it immediately becomes clear that there are much better alternatives out there for the money...
 
yea, it's basicaly a super awesome bulletproof $100 router/firewall, that costs far more.
 
You must log in or register to reply here.
Back
Top