3

I'm currently in a process of NATed and mainly L2 based network migration to a proper routed design and got a little confused reading lots of documentation on the net for what I really need. Bellow I attached a figure to better understand what I seek - basically to know what to do in the cloud with question mark.

What I have is:

  • A working BGP provider edge with failover;
  • An aggregation switch that has a couple dozen remote switches connected to it;
  • ~900 clients that are ordinary people with SOHO routers.

I know that I want to:

  • Assign public IPs to end clients from 1.0.0.0/21 via DHCP;
  • Rationally use my public IP subnet (1.0.0.0/21);
  • Probably have every remote switch in a separate vlan;
  • Do rate limiting and firewalling for clients;
  • Have some sort of redundancy only for failed hardware (dual links to remote switches are not possible).

I do not want to:

  • Use PPPoE for authentication.

I'm aware that there's an easy way: to put a firewalled bridge between aggregation switch and a BGP router, assign few IP addresses and use it as a gateway for clients, but I think that would be stupid.

I only need a design advice and/or some insights.

Many thanks in advance!

Demonstration figure

Improve this question
5
  • When you say "remote" switches, what do you mean? how far are they from the edge devices? What do you connect them with? fiber? copper? What speed? What kind of switches are they? Do you have a mfr preference?
    – Ron Trunk
    Jun 8 '14 at 16:38
  • Remote switches are those that are connected (trunked) to the switch in the picture above. They are located in cabinets in residential areas and provide Internet access to users. Switches are managed L2 switches with some L3 capabilities. All links are fiber. Even to the individual users. Our current uplink to ISP is 1Gbps and currently we average at ~300mbps load, but I expect that to increase after eliminating NAT. Users are not evenly distributed across switches, some have many, some have only a few connected. If by 'mfr' you mean manufacturer, then the answer is No.
    – squirrely
    Jun 8 '14 at 22:04
  • @squirrely are your questions answered now?
    – Mike Pennington
    Jun 20 '14 at 9:22
  • This question is way to open and broad - there are multiple "sub" questions here.
    – jwbensley
    Jul 9 '14 at 21:00
  • Well, in part I can agree that it's quite broad question. But it definitely can be answered with a couple of words IMO. As in my case, I've put a L3 firewall in place of cloud with question mark and left everything L2 downwards adding various traffic segmentation and trunking capabilities.. Works fine ever since.
    – squirrely
    Jul 11 '14 at 8:23
3

One solution is to use two L3 switches as your aggregation layer. To lessen the impact of a failure, two L3 switches are used; half of the remote switches connect to one, half to the other.

The remote switches are trunked to the agg switches, and two vlans are created for each switch: a user vlan and a management vlan.

You also create a VLAN with a L3 interface on each switch to connect your Internet routers. Optionally, you can place a firewall between the routers and your switches.

I can go into more detail if you need it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.