PC Pro - UK 2021-12)

Expertadvicefromourpanelofprofessionals

Real world

computing

JONHONEYBALL

C

hangingcoreinfrastructureis

alwayshard,alwaysfraught

withcomplicationsandalways

littered withunexpectedroadblocks.

That’swhywedoitsoinfrequently,

andusually afteranappropriate

periodof consideration,testingand

verification.Transitioninga large

networkissomethingthatmustbe

doneover a periodof time,so

coexistenceisalwaysa critical

factorbecausethereisneverone

homogenoussolutioninplace.

Afteraboutsix yearsofharduse,it

wasnecessaryto lookagainatour

corenetworkswitching,firewalls and

Wi-Fiaccesspoints.ThesolutionI put

inplacebackthenwasfromCisco

Meraki,a cloud-baseduser-friendly

platformthatcanscaletoglobal

enterprises.Onebenefitisthatit

doesn’tdragyouintothedeepdark

holethatisthe Ciscocommandline.

It’sworkedwellandbeenvery

reliable,but onewordI wouldn’tuse

todescribeitischeap.Thatappliesto

boththehardwareandthelicences

requiredtorunit.Worsestill,when

thelicenceexpiresthedevicesstop

working.There’sno“fallbackto

basicmode”onoffer: you’reeither

licensedoryournetworkgoesdark.

WhichisoneofthereasonswhyI

started looking:thethousandsI spent

onlicensingfour-and-a-halfyear

agowascomingupforrenewal.A

withnumerouschangesinthe

network,itwasn’ta simplecaseo

handingovera largecheque to k

theexistingsystem running.

Backthen,eachofourfour

siteswaslogicallyseparated,so

eachhada firewall/routerandat

leastoneormoreWi-Fiaccesspoints

(APs).Themainlabbuildingalsohas

a48-portswitchatitsheart.

Thenchangecamealong.First,it

becamepossibletogetfibreto

interconnecteachsitebacktoour

rackinthedatacentreatMerula,our

ISP,wherethedatacentreisa few

buildingsawayfromthemainlab.

Thisremovedtheneedforallbutone

oftheMerakifirewall routers.

ThenI discoveredtheremaining

firewallwaslimitedto250Mbits/sec

throughput,which wassomewhat

disappointinggiventhatwe nowhad

uncontended1Gbit/secspeedtothe

outsideworldonthefibre.

I decidedto replaceitwithameaty

Netgatefirewallrouterrunningits

pfSenseplatform,asyoumay

rememberfromthiscolumna year

orsoago(seeissue 308 ,p 112 ).

Thisleftthe 48-portswitch anda

bunch of high-quality andversatile

APs,butonesthatwerelooking

creakyas theywerestuckonthe

old802.11acstandard.

Clearlypayingtheextra-wide

invoicetorenewalltheMeraki

licenceswasn’tgoingtomakesense,

andalthoughI couldhavepruned

backthelicensingto coverthedevices

stillinuse,it wastimetoupgradethe

APstoWi-Fi6 anyway.

Now,ourneedsareactuallyquite

simple.Startingwiththenetwork

switching,itwould have been

tempting to go with dump or

semi-managedswitches, on the

groundsthat this wouldhave

probablyworkedjustfine.ButI also

wantedsome 1 0GbEportsforcore

networkdevices.AndsomePoEtoo,

torundevicessuchasoursecurity

cameras.RemovingredundantPoE

injectorsalwaysfeelslikea goodidea,

becauseit’sonesmalladditionalitem

thatcanberemovedandthus

improvesoverallreliability.

IdeallyI wanteda fullymanaged

setup,becausethatwayI couldgeta

wholenetworkviewofthemulti-site

plan,whichisveryuseful when

trying to workoutwhya particular

device is chattingtoo much.AndI

mostcertainlywantedhigh-quality

analyticsoftrafficpatternsandflows.

Sowhynotjustdoallofthisonthe

pfSenseinstallationalreadyinplace?

Well,pfSenseis powerful,butit’salso

quitegeeky;I haveneitherthetime

northeinclination to do a deepdive

intoit.I’veinstalledNTOPNG,pfTOP

andso forth,butitwasn’tgivingme

thesortofanalyticsthatI wanted.

A friend pointedmeinthe

directionofUbiquiti,a previous

winnerofthePCProExcellence

d forrouters,whichisalwaysa

sign(seep 27 forthisyear’s

• Ed).Its offeringslooked
  , arewellpricedandthere’sno
  inglicencefee,either.Italso
  a wholerangeof10GbE
  rdware,includinga coreswitch
  hatwouldbeideal in thelaband
  8-portswitch.I brieflylogged
  myfriend’sinfrastructure
  atfirstglancelikedwhat I saw.
  nlyliked thewayit could
  thenetworkwithalldevices
  ledinthetree.Andtheanalytics
  essed,withparticularlygood

JonistheMDofanIT

consultancythat

specialisesintesting

anddeployingkit

@jonhoneyball

“Transitioningalargenetwork

mustbedoneoveraperiodoftime,

socoexistenceisalwayscritical”

JonsharesthetrialsofhismigrationfromCiscoMeraki,somethoughtson

Windows 365 CloudPCsanda cunningwaytofightspamphonecalls

BELOWUbiquiti’s

hardwaredesignis

rightuptherewith

thelikesofApple

“It’sworked

wellandbeen

reliable,butone

wordIwouldn’t

usetodescribe

itischeap”