Category: Arch

Wireless Design Principles

 

 

 

  • Wireless Signal Mesured in dBm ( Power referenced against one Milliwatt )
  • Range is roughly -30dBm to -90dBm
    • -30dBm = Max Achievable ( not desired ).
    • -67dBm = Mininum for real-time Apps.
    • -80dBm = Minimum for communication.
  • Noise is always a challenge
  • Signal to Noise Ratio ( SNR ) = ( SignalNoise ) = Value
    • Mininum SNR of 25 is needed for real-time apps.

(more…)

Multicast and Multicast Routing

Unicast vs Multicast

  • Routed via PIM ( Protocol Independent Multicast ).
  • Always UDP-Based ( Video, Audiostreams, some kinds of data ).
  • Typical network challenges ( QoS, Security, Bandwidth consumption).
  • Began as a ‘speciality’ technology, becoming heavily adopted in modern times.

Multicast Addresses

  • Multicast group members receive all data center to a group.
  • Multicast IPv4 Range: [ 224.0.0.0  239.255.255.255 ]
    • Filtering tip:
      • Last 23 bits of IP mapped to MAC
        • Can lead to overlapping addresses

(more…)

VPN Design

Remote Access VPN design

  • For a VPN you need a termination device (vpn concentrator / Firewall), a client and the connecting technology for tunneling.
  • Cisco Easy VPN.
  • Client options
    • IPSEC VPN client
    • SSLVPN Clientless Access
    • SSLVPN Thin client
    • SSLVPN Thick client

Placement of the VPN Termination Device:

(more…)

E-Commerce Implementation

Core layer

  • Cisco 6509.
  • Static routing used to ISP ( or basic BGP ).
  • FWSM or ACE module used as initial filter.
  • Static route down to VIP of aggregation layer FHRP.

Aggregation Layer

  • Cisco 6506 ( MSFC ).
  • Traffic received from core routed to CSM
  • CSM load balances to VLANs at the access layer
  • Simple Design allows inter-vlan routering ( web, app, db )
    • Inter-vlan routing without a FWSM can lead to access from the VLANs.

Access Layer

  • Cisco 6509
  • Servers typically devided into web, app, and database VLANS.
  • Server gateways set to CSM, FWSM, or VIP of the FHRP on L3.
  • Firewall restrictions between layers common.

E-Commerce

A design that must stay up

  • Public face of an organization
  • The place where downtime is incredibily harmful
  • The place where budgets are approved\

Ultra Redundant, Ultra secure Firewall Design

  • Only Method through layers is via servers
  • Option of using different firewall vendors at different layers
  • Supports virtual firewall using FWSM (Firewall Services Module) or ACE (Application controle engine) module

(more…)

IPv6 Review

  • Unicast:  One-to-one.
  • Multicast: One-to-many.
  • Anycast: One-to-closest.

 

  • Link-local scope address:  layer2 domain
  • Unique / Site-local scope address: Organization
  • Global scope address: Internet

(more…)

Datacenter Design III (STP, High availability, Failover timers)

STP in the datacenter

STP logical interfaces maximum

  • RSTP / MST reach topology maximus. Switch specs logical / virtual interfaces.  (6500/ 6748)
    • Logical interfaces == ((trunk ports * vlans ) + non-trunk interfaces)
    • Virtual interfaces ( Per line card ) = (( trunk ports * vlans ))
    • verify with ‘show spantree sum total

Example logical interfaces:

6500 Chassis:

  • 120 VLANS
  • 49 Access layer switches
  • 2 connections to each switch ( double uplink but with etherchannel counts as 1 logical interface )
  • 1 Cross Connect to secondary Agg Switch.
  • 30 other devices connected
    • (( 120 * 50 ) + 30 ) = 6030 Logical interface (out of 10,000 max)

Example Virtual interfaces:

Cisco 6748 Linecard

  • 120 VLANS
  • 12 Access layer switches, 4 Etherchannel-bundled connections.
    • 12 x 4 = 48 ports  ( Virtual interfaces counts every interface )
      • ( 120 * 48 ) = 5760 Virtual Interfaces (out of 1800 max)

High Availability

Nic teaming options

  • Adapter fault tolerance (AFT):  active / standby  – Two nics  One switch
  • Switch fault tolerance (SFT):  active / standby  – Two nics Two switches
  • Adaptive Load Balancing (ALB):  active / active – One IP Two Macs
  • Etherchannel – LAG

Expectations and Failover Timers

OperationFailover time
OSPF / EIGRPSubsecond
RTSP1-2 Seconds
Etherchannel1 Second
HSRP Timers3 Seconds
Service Modules1-5 Seconds
Windows TCP Stack Tolerance9 Seconds

Datacenter Design II (Blades, Scaling, Bandwidth)

Blade Server design

  • Overleg with the server team connectivity.
  • Many blade servers enter de “enterprise switch” market with an integrated switch.
  • Pass-through cabling or integrated switches.
  • Significant impact on power – cooling – weight.

Connecting the blade to the network

  • If you use the integrated blade switch, use a layer3 access layer.
  • Avoid a double Layer 2 design:
    •  [Layer 2 on the access layer] connected to a [layer 2 domain within the bladeswitch].
  • If you use passthrough, use a layer2 or layer3 access layer.

Scaling the Datacenter Architecture

(more…)

Datacenter Design I (Core, Aggregation, Access Designs)

Core

  • Not all datacenter designs needs a core layer
  • Access to aggregation, aggregation to core : 10 or 40GBps
  • CEF load balancing tuning (L3 + L4)
  • Core should run L3 only, Aggregation acts as L3/L2 boundry to access
  • Core runs OSPF / EIGRP with aggregation

Aggregration

(more…)