4

Made a diagram for a new network we are going to be laying out here. I have never done this before, and i'm still fairly new to Cisco / Networking, so does anyone see any issues with the way I have it laid out?

We are moving to an ERP platform for all business operations soon, and it is a web driven app that we will be hosting, so performance for that is probably the most critical thing I am worried about.

enter image description here

enter image description here

  • 1
    Be sure to come up with a good QoS plan, else you will find your VoIP messing up. Cisco recommends a 20:1 access to distribution ratio. That means for every 20 1 Gb access ports, you need 1 Gb in your uplink to the distribution. This drawing doesn't seem show that since your uplinks seem to be only 1 Gb. – Ron Maupin Mar 26 '15 at 19:50
  • So best would be to have 10GB links from KENPCKSW1 to KENDCSW1 and from KENHRSW1 to KENDCSW1? The other 10/100 switches will have less than 15 users on them – Matt Fogleman Mar 26 '15 at 20:00
  • 1
    You could channel ports. Quick math shows KENHRSW1 could channel three or four 1 Gb ports up to the distribution switch to cover all the ports on and downstream from it (67.2 Gb / 20 = 3.36 Gb), and the same on KENPCKSW1 (62.4 Gb / 20 = 3.12 Gb). – Ron Maupin Mar 26 '15 at 20:23
  • 1
    Where are you routing between the VLANs? The 3750G is a poor choice for that. – Ron Maupin Mar 26 '15 at 20:24
  • 1
    If you are concerned about performance above all, you need a comprehensive QoS policy which requires much router CPU utilization. You may find the switch CPU inadequate with all the processes with which you are burdening it. Even a small router is a better choice for the routing and QoS processing. Mark on the access switch, and queue on the router. – Ron Maupin Mar 26 '15 at 20:41
4

You should remove the 3750G (not much flash size for future IOS upgrades) as your core and replace it with two 3750X (or better) stacked together. Also implement stack-power should one of the power supplies fail. Make the core your spanning-tree root if not already.

All of your distribution switches should directly dual-connect to the core 3750x stack to provide redundancy. Use etherchannels :-)

Dual-connect your access switches to the two distribution switches (with etherchannels if you can), that way should one of the distribution switches fail and they do, the network will suffer from a very minimal outage while spanning tree recalculates.

Your servers connectivity could be improved by connecting them to a dedicated datacentre switch. Some of the Dell powerconnect switches are very popular and more affordable in some instances. They should also be in their own private vlan.

Don't forget to add a good network UPS to your individual switches and servers, should power fail, you would have time to save your data and perform graceful shutdowns if required.

There are quite a few more suggestions to add to your design such as QoS for VoiP, etc , but I guess it is a starting point to provide redundancy and uptime to your clients :-)

  • Thanks for the comments! Don't think our budget can afford much past what I have laid out right now. We are not a huge business, this would all be for about 250 connected devices, including servers, wifi, workstations and IP phones. Any good resources on where to start for QoS for VOIP? Thats really something I have little to no experience with. – Matt Fogleman Mar 26 '15 at 20:14
  • Cisco recommends routing with eigrp between access and distribution layers because eigrp converges a lot faster than STP. The downside being a lot more ip networks. Even though I knew that recommendation I still went with STP, so it depends on how badly you want fastest convergence. – Todd Wilcox Mar 26 '15 at 21:52
  • This Cisco centric document link should help with QoS, it does have pictures :-) cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/… – user4565 Mar 27 '15 at 21:43
2

I would either eliminate VLAN 1 if you can, or let VLAN 1 just be for cisco and networking traffic and put all other traffic on other VLANs. Also I would make a VLAN just to be the native VLAN on trunks between switches or have no native VLAN on inter-switch links. And make a separate VLAN for servers and ideally one more for management.

See: http://www.ciscopress.com/articles/article.asp?p=2181837&seqNum=11

  • 2
    Actually, any VLAN numbered 1, and any untagged VLANs, are considered a security risk. There are documented attack vectors using these sorts of VLANs. Layer-2 security is very important since most successful attacks come from within an organization, whether intentional by a member of the organization or unintentional through malware, and layer-2 security can be complex. Simple steps, such as eliminating these types of VLANs, are easy and should be implemented. – Ron Maupin Mar 27 '15 at 0:26
  • Looks like the ability to clear VLAN 1 from a trunk is relatively new in Cisco Catalyst switches (new relative to my career and history of working on Cisco gear). Either way, it's definitely recommended to not use VLAN 1 for any user traffic and to only allow VLANs where they are needed. informit.com/library/… – Todd Wilcox Mar 27 '15 at 1:10
  • 1
    An excellent resource is the Cisco book, "LAN Switch Security: What Hackers Know About Your Switches." It details many attack vectors and protocol weaknesses. Typically, you want to disable any layer-2 protocol negotiations (set access and trunk ports to disable negotiation) where possible, manually set VLAN allowed lists on trunks, etc. – Ron Maupin Mar 27 '15 at 1:32
  • Agreed. Port security, DHCP snooping, etc., are all good things also, although maybe a bit much for the OP to take on being self-described as "fairly new" to this. – Todd Wilcox Mar 27 '15 at 1:42
  • That's why I only recommended the simple steps of not using VLAN 1 or having any untagged VLANs. – Ron Maupin Mar 27 '15 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.