4

Made a diagram for a new network we are going to be laying out here. I have never done this before, and i'm still fairly new to Cisco / Networking, so does anyone see any issues with the way I have it laid out?

We are moving to an ERP platform for all business operations soon, and it is a web driven app that we will be hosting, so performance for that is probably the most critical thing I am worried about.

enter image description here

enter image description here

Improve this question
12
  • 1
    Be sure to come up with a good QoS plan, else you will find your VoIP messing up. Cisco recommends a 20:1 access to distribution ratio. That means for every 20 1 Gb access ports, you need 1 Gb in your uplink to the distribution. This drawing doesn't seem show that since your uplinks seem to be only 1 Gb.
    – Ron Maupin ♦
    Commented Mar 26, 2015 at 19:50
  • So best would be to have 10GB links from KENPCKSW1 to KENDCSW1 and from KENHRSW1 to KENDCSW1? The other 10/100 switches will have less than 15 users on them
    – Matt Fogleman
    Commented Mar 26, 2015 at 20:00
  • 1
    You could channel ports. Quick math shows KENHRSW1 could channel three or four 1 Gb ports up to the distribution switch to cover all the ports on and downstream from it (67.2 Gb / 20 = 3.36 Gb), and the same on KENPCKSW1 (62.4 Gb / 20 = 3.12 Gb).
    – Ron Maupin ♦
    Commented Mar 26, 2015 at 20:23
  • 1
    Where are you routing between the VLANs? The 3750G is a poor choice for that.
    – Ron Maupin ♦
    Commented Mar 26, 2015 at 20:24
  • 1
    If you are concerned about performance above all, you need a comprehensive QoS policy which requires much router CPU utilization. You may find the switch CPU inadequate with all the processes with which you are burdening it. Even a small router is a better choice for the routing and QoS processing. Mark on the access switch, and queue on the router.
    – Ron Maupin ♦
    Commented Mar 26, 2015 at 20:41

2 Answers 2

Reset to default
4

You should remove the 3750G (not much flash size for future IOS upgrades) as your core and replace it with two 3750X (or better) stacked together. Also implement stack-power should one of the power supplies fail. Make the core your spanning-tree root if not already.

All of your distribution switches should directly dual-connect to the core 3750x stack to provide redundancy. Use etherchannels :-)

Dual-connect your access switches to the two distribution switches (with etherchannels if you can), that way should one of the distribution switches fail and they do, the network will suffer from a very minimal outage while spanning tree recalculates.

Your servers connectivity could be improved by connecting them to a dedicated datacentre switch. Some of the Dell powerconnect switches are very popular and more affordable in some instances. They should also be in their own private vlan.

Don't forget to add a good network UPS to your individual switches and servers, should power fail, you would have time to save your data and perform graceful shutdowns if required.

There are quite a few more suggestions to add to your design such as QoS for VoiP, etc , but I guess it is a starting point to provide redundancy and uptime to your clients :-)

Improve this answer
3
  • Thanks for the comments! Don't think our budget can afford much past what I have laid out right now. We are not a huge business, this would all be for about 250 connected devices, including servers, wifi, workstations and IP phones. Any good resources on where to start for QoS for VOIP? Thats really something I have little to no experience with.
    – Matt Fogleman
    Commented Mar 26, 2015 at 20:14
  • Cisco recommends routing with eigrp between access and distribution layers because eigrp converges a lot faster than STP. The downside being a lot more ip networks. Even though I knew that recommendation I still went with STP, so it depends on how badly you want fastest convergence.
    – Todd Wilcox
    Commented Mar 26, 2015 at 21:52
  • This Cisco centric document link should help with QoS, it does have pictures :-) cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/…
    – user4565
    Commented Mar 27, 2015 at 21:43
2

I would either eliminate VLAN 1 if you can, or let VLAN 1 just be for cisco and networking traffic and put all other traffic on other VLANs. Also I would make a VLAN just to be the native VLAN on trunks between switches or have no native VLAN on inter-switch links. And make a separate VLAN for servers and ideally one more for management.

See: http://www.ciscopress.com/articles/article.asp?p=2181837&seqNum=11

Improve this answer
11
  • 2
    Actually, any VLAN numbered 1, and any untagged VLANs, are considered a security risk. There are documented attack vectors using these sorts of VLANs. Layer-2 security is very important since most successful attacks come from within an organization, whether intentional by a member of the organization or unintentional through malware, and layer-2 security can be complex. Simple steps, such as eliminating these types of VLANs, are easy and should be implemented.
    – Ron Maupin ♦
    Commented Mar 27, 2015 at 0:26
  • Looks like the ability to clear VLAN 1 from a trunk is relatively new in Cisco Catalyst switches (new relative to my career and history of working on Cisco gear). Either way, it's definitely recommended to not use VLAN 1 for any user traffic and to only allow VLANs where they are needed. informit.com/library/…
    – Todd Wilcox
    Commented Mar 27, 2015 at 1:10
  • 1
    An excellent resource is the Cisco book, "LAN Switch Security: What Hackers Know About Your Switches." It details many attack vectors and protocol weaknesses. Typically, you want to disable any layer-2 protocol negotiations (set access and trunk ports to disable negotiation) where possible, manually set VLAN allowed lists on trunks, etc.
    – Ron Maupin ♦
    Commented Mar 27, 2015 at 1:32
  • Agreed. Port security, DHCP snooping, etc., are all good things also, although maybe a bit much for the OP to take on being self-described as "fairly new" to this.
    – Todd Wilcox
    Commented Mar 27, 2015 at 1:42
  • That's why I only recommended the simple steps of not using VLAN 1 or having any untagged VLANs.
    – Ron Maupin ♦
    Commented Mar 27, 2015 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.