Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171439 > unrolled thread

networking

Back to article view | Back to linux.debian.user

Contents

  networking Pol Hallen <deben@fuckaround.org> - 2016-08-26 12:50 +0200
    Re: networking Dan Ritter <dsr@randomstring.org> - 2016-08-26 13:10 +0200
      Re: networking Pol Hallen <deben@fuckaround.org> - 2016-08-26 13:20 +0200
    Re: networking Nicolas George <george@nsup.org> - 2016-08-26 13:30 +0200
      Re: networking Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-26 14:00 +0200
        Re: networking Nicolas George <george@nsup.org> - 2016-08-26 14:10 +0200
      Re: networking Paul Johnson <baloo@ursamundi.org> - 2016-08-26 15:10 +0200
      Re: networking Michael Milliman <michael.e.milliman@gmail.com> - 2016-08-27 14:30 +0200
        Re: networking Nicolas George <george@nsup.org> - 2016-08-27 14:40 +0200
    Re: networking "Karl E. Jorgensen" <karl@jorgensen.org.uk> - 2016-08-26 14:20 +0200
      Re: networking Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-26 15:10 +0200
    Re: networking Debian maillists <debian@kompas.net.pl> - 2016-08-26 14:30 +0200
      Re: networking Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-26 15:10 +0200
      Re: networking Pol Hallen <deben@fuckaround.org> - 2016-08-26 15:30 +0200
        Re: networking Debian maillists <debian@kompas.net.pl> - 2016-08-27 13:40 +0200
    Re: networking Pol Hallen <deben@fuckaround.org> - 2016-08-26 15:40 +0200

#171439 — networking

Hi all, I'm helping a friend to create a small network on his office (4 
floors)

I suggests him to separate each networks:

floor1 - 192.168.1.0/24
floor2 - 192.168.2.0/24
floor3 - 192.168.3.0/24
floor4 - 192.168.4.0/24

DSL <--> SERVER <--> WAN - 192.168.10.0/24
		     NIC1 - 192.168.1.0/24 <--> switch
		     NIC2 - 192.168.2.0/24 <--> switch
		     NIC3 - 192.168.3.0/24 <--> switch
		     NIC4 - 192.168.4.0/24 <--> switch

what is better? A linux server with 5 NICS (for all floors) or a 
dedicated and cheapest router with 5 NICS? (DSL <--> SERVER <--> ROUTER)

any suggests is useful :-)

thanks for help!

Pol

[toc] | [next] | [standalone]

#171440

On Fri, Aug 26, 2016 at 12:43:30PM +0200, Pol Hallen wrote:
> Hi all, I'm helping a friend to create a small network on his office (4
> floors)
> 
> I suggests him to separate each networks:
> 
> floor1 - 192.168.1.0/24
> floor2 - 192.168.2.0/24
> floor3 - 192.168.3.0/24
> floor4 - 192.168.4.0/24
> 
> DSL <--> SERVER <--> WAN - 192.168.10.0/24
> 		     NIC1 - 192.168.1.0/24 <--> switch
> 		     NIC2 - 192.168.2.0/24 <--> switch
> 		     NIC3 - 192.168.3.0/24 <--> switch
> 		     NIC4 - 192.168.4.0/24 <--> switch
> 
> what is better? A linux server with 5 NICS (for all floors) or a dedicated
> and cheapest router with 5 NICS? (DSL <--> SERVER <--> ROUTER)

You have several choices.

1. Use a switch for each floor, connect them individually to a
router. All cross-floor communication will need to pass through
the router. This is good for control - you can do firewall
functions between floors as well as to the outside.

2. Use a single switch for all floors, in which case all your
cables need to go to it. This may be a wiring problem. You can
then connect a router to that for Internet access.

3. Use a switch for each floor and connect them to a master
switch next to your router. If the router dies, you still have
cross-floor networking.

4. Use a multi-chassis switch, with one body per floor,
connecting them across floors with suitable cabling. This is
like a hybrid of (2) and (3), offering a lower cost than a giant
switch but the same single management point.

5. Use a switch for each floor, use a router for each floor,
have multiple connections to your central router. (And note that
many mid-to-high end switches have some routing capabilities.)
This can give you resiliency against cable breaks, and local
control as well.

-dsr-

[toc] | [prev] | [next] | [standalone]

#171441

Hi Dan

> 1. Use a switch for each floor, connect them individually to a
> router. All cross-floor communication will need to pass through
> the router. This is good for control - you can do firewall
> functions between floors as well as to the outside.

nice :-)

> 3. Use a switch for each floor and connect them to a master
> switch next to your router. If the router dies, you still have
> cross-floor networking.

can you explain me this scenario?

> 4. Use a multi-chassis switch, with one body per floor,
> connecting them across floors with suitable cabling. This is
> like a hybrid of (2) and (3), offering a lower cost than a giant
> switch but the same single management point.

which hardware needs this scenario?

thanks for help :)

Pol

[toc] | [prev] | [next] | [standalone]

#171442

[Multipart message — attachments visible in raw view] — view raw

Le decadi 10 fructidor, an CCXXIV, Pol Hallen a écrit :
> I suggests him to separate each networks:
> 
> floor1 - 192.168.1.0/24
> floor2 - 192.168.2.0/24
> floor3 - 192.168.3.0/24
> floor4 - 192.168.4.0/24

Why?

You give way too few information about the needs of your friend to allow
anyone to give relevant advice. If someone did, it was just by exercising
supernatural divination powers.

(Also, I wonder why people always fiddle with the cumbersome 192.168 instead
of going for simply 10.)

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#171443

Le 26/08/2016 à 13:19, Nicolas George a écrit :
>
> You give way too few information about the needs of your friend to allow
> anyone to give relevant advice.

Indeed. A "best" solution is only optimal for a given set of requirements.

> (Also, I wonder why people always fiddle with the cumbersome 192.168 instead
> of going for simply 10.)

What's cumbersome in 192.168 ? More digits to type ?

[toc] | [prev] | [next] | [standalone]

#171444

[Multipart message — attachments visible in raw view] — view raw

Le decadi 10 fructidor, an CCXXIV, Pascal Hambourg a écrit :
> What's cumbersome in 192.168 ? More digits to type ?

Yes, that, and all that goes along: readability and ease to see typos, ease
to remember for non-tech-savvy people, etc.

[toc] | [prev] | [next] | [standalone]

#171456

[Multipart message — attachments visible in raw view] — view raw

On Fri, Aug 26, 2016 at 6:19 AM, Nicolas George <george@nsup.org> wrote:

>
> (Also, I wonder why people always fiddle with the cumbersome 192.168
> instead
> of going for simply 10.)
>
>
While it shouldn't matter, I've seen some serious networking brain damage
if your router or the border router happen to be both trying to handle the
same subnet, even in "nonroutable" space.  If your upstream provider is
using 10/8 space, then using 192.168/16 sidesteps that potential for
conflict completely.

[toc] | [prev] | [next] | [standalone]

#171477

On 08/26/2016 06:19 AM, Nicolas George wrote:
> Le decadi 10 fructidor, an CCXXIV, Pol Hallen a écrit :
>> I suggests him to separate each networks:
>>
>> floor1 - 192.168.1.0/24
>> floor2 - 192.168.2.0/24
>> floor3 - 192.168.3.0/24
>> floor4 - 192.168.4.0/24
> Why?
>
> You give way too few information about the needs of your friend to allow
> anyone to give relevant advice. If someone did, it was just by exercising
> supernatural divination powers.
>
> (Also, I wonder why people always fiddle with the cumbersome 192.168 instead
> of going for simply 10.)
And the difference?? Both are designated for private use.  192.168 
simply has less address space.  10. can certainly be used, as can 
192.168, either in a number of configurations.  Neither is really more 
cumbersome than others.  Its all in how you define your network space.
> Regards,
>

-- 
73's
Mike, WB5VQX

[toc] | [prev] | [next] | [standalone]

#171478

[Multipart message — attachments visible in raw view] — view raw

Le primidi 11 fructidor, an CCXXIV, Michael Milliman a écrit :
> And the difference??

This question was already asked and answered.

[toc] | [prev] | [next] | [standalone]

#171446

On Fri, Aug 26, 2016 at 12:43:30PM +0200, Pol Hallen wrote:
> Hi all, I'm helping a friend to create a small network on his office (4
> floors)
> 
> I suggests him to separate each networks:
> 
> floor1 - 192.168.1.0/24
> floor2 - 192.168.2.0/24
> floor3 - 192.168.3.0/24
> floor4 - 192.168.4.0/24
> 
> DSL <--> SERVER <--> WAN - 192.168.10.0/24
> 		     NIC1 - 192.168.1.0/24 <--> switch
> 		     NIC2 - 192.168.2.0/24 <--> switch
> 		     NIC3 - 192.168.3.0/24 <--> switch
> 		     NIC4 - 192.168.4.0/24 <--> switch
> 
> what is better? A linux server with 5 NICS (for all floors) or a dedicated
> and cheapest router with 5 NICS? (DSL <--> SERVER <--> ROUTER)

As others have noted, there is not enough information here to decide
what is best...

However...

You may want to for different networks to allow for future
expansion. Your current scheme will only allow for max ~ 250 clients
per floor.  And you have the IP ranges rubbing against each other
without gaps...

It is usually a good idea to leave "space" between the IP ranges to
allow them to expand without too much trouble. And avoid making the IP
range too narrow - running out of IP addresses is nasty.

For example:

floor1 - 192.168.128.0/20  [ 192.168.128.0 ... 192.168.143.255 ]
floor2 - 192.168.160.0/20  [ 192.168.160.0 ... 192.168.175.255 ]
floor3 - 192.168.192.0/20  [ 192.168.192.0 ... 192.168.207.255 ]
floor4 - 192.168.224.0/20  [ 192.168.224.0 ... 192.168.239.255 ]

With /20 it allows for ~4000 devices per floor. And there are "gaps"
in the IP ranges to allow for expansion, so if the population of a
floor grows, it can grow to a /19 without clashing with the next
floor.

In each IP range you need to allow IP addresses for:

  default gateway (traditionally the first IP in the range. Or
                   the last. Convention differs.)
  broadcast address
  network address (not sure this is needed nowadays, but I tend do...)

and you may also want to reserve a block (16 or 32 IPs) at the
beginning/end of each network range for devices with fixed IP
addresses - e.g. your dhcp server (unless you let the router forward
DHCP/BOOTP), DNS server (which may or may not be on the same network)
and other stuff that crops up.
  
Of course, here we seem to be talking about wired access. Wireless
access probably should have its own IP range (and allow for a sizeable
number of devices) as it will probably not be specific to a floor...
You could treat this as a different (less trusted) floor....

Hope this helps
--
Karl

[toc] | [prev] | [next] | [standalone]

#171454

Le 26/08/2016 à 13:55, Karl E. Jorgensen a écrit :
>
> You may want to for different networks to allow for future
> expansion. Your current scheme will only allow for max ~ 250 clients
> per floor.  And you have the IP ranges rubbing against each other
> without gaps...
>
> It is usually a good idea to leave "space" between the IP ranges to
> allow them to expand without too much trouble. And avoid making the IP
> range too narrow - running out of IP addresses is nasty.

If you're going that way, then you'd better use /16 subnets in 
172.16.0.0/12 or in 10.0.0/8, allowing 65534 hosts per subnet from the 
start.

> For example:
>
> floor1 - 192.168.128.0/20  [ 192.168.128.0 ... 192.168.143.255 ]
> floor2 - 192.168.160.0/20  [ 192.168.160.0 ... 192.168.175.255 ]
> floor3 - 192.168.192.0/20  [ 192.168.192.0 ... 192.168.207.255 ]
> floor4 - 192.168.224.0/20  [ 192.168.224.0 ... 192.168.239.255 ]
>
> With /20 it allows for ~4000 devices per floor. And there are "gaps"
> in the IP ranges to allow for expansion, so if the population of a
> floor grows, it can grow to a /19 without clashing with the next
> floor.

Prefix lengths which are not multiple of 8 suck for readability. There 
is plenty of space in the private ranges, so why bother with complicated 
netmasks and ranges ?

[toc] | [prev] | [next] | [standalone]

#171450

On Fri, 26 Aug 2016, Pol Hallen wrote:

> I suggests him to separate each networks:
> 
> floor1 - 192.168.1.0/24
> floor2 - 192.168.2.0/24
> floor3 - 192.168.3.0/24
> floor4 - 192.168.4.0/24

Why do you want to separate it?
And if you really need separation then why just on floor
borders? Is your organisation divided into floors or
into sections, divisions etc...?
If you really need to separate your organisation sections
use managed switches and VLANs, not subnetworks.

Jerzy

[toc] | [prev] | [next] | [standalone]

#171455

Le 26/08/2016 à 14:22, Debian maillists a écrit :
>
> If you really need to separate your organisation sections
> use managed switches and VLANs, not subnetworks.

How do you use VLANs without subnetting ?

[toc] | [prev] | [next] | [standalone]

#171457

> Why do you want to separate it?

try to discover a network problem when there're many many devices 
online... if you separate is become "easy" audit network

> Is your organisation divided into floors or
> into sections, divisions etc...?

this scenario by floors. Is it strange? :-|

> If you really need to separate your organisation sections
> use managed switches and VLANs, not subnetworks.
				  ^^^^^^^^^^^^^^^
BUMP!

Pol

[toc] | [prev] | [next] | [standalone]

#171476

On Fri, 26 Aug 2016, Pol Hallen wrote:

> >Why do you want to separate it?
> 
> try to discover a network problem when there're many many devices 
> online... if you separate is become "easy" audit network

You divide number of computers affected by a problem by 4 and
add many new problems caused by routing.

> 
> >Is your organisation divided into floors or
> >into sections, divisions etc...?
> 
> this scenario by floors. Is it strange? :-|
> 

The most important reason to add separation to network is
security. And when you need security dividing network into floors
is strange.
We do not know what is your network purpose. What applications,
what servers do you use.
If you need just internet access or access to external servers
for 100-200 computers and have no security constrains then
scenario "by floors" may be the best.
But if it is a typical internal network with few internal servers,
windows applications, shared folders, guests with notebooks looking
for internet access and financial or personal data flying everywhere
then better divide it by organisational units.

[toc] | [prev] | [next] | [standalone]

#171458

sorry for the incomplete question: each floor will has not more than 
20/30 devices (mixed: wifi + wired). We connect some AP to switch 1-4

and thanks for all replies :-)

Pol

On 08/26/2016 12:43 PM, Pol Hallen wrote:
> Hi all, I'm helping a friend to create a small network on his office (4
> floors)
>
> I suggests him to separate each networks:
>
> floor1 - 192.168.1.0/24
> floor2 - 192.168.2.0/24
> floor3 - 192.168.3.0/24
> floor4 - 192.168.4.0/24
>
> DSL <--> SERVER <--> WAN - 192.168.10.0/24
>              NIC1 - 192.168.1.0/24 <--> switch
>              NIC2 - 192.168.2.0/24 <--> switch
>              NIC3 - 192.168.3.0/24 <--> switch
>              NIC4 - 192.168.4.0/24 <--> switch
>
> what is better? A linux server with 5 NICS (for all floors) or a
> dedicated and cheapest router with 5 NICS? (DSL <--> SERVER <--> ROUTER)
>
> any suggests is useful :-)
>
> thanks for help!
>
> Pol
>


-- 
Pol

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web