To route or not?

[Russ_57]

Small k12 school district, about 1200 nodes, all schools connected to central office via fiber. Currently using 4108 in central office, 4000M's as the "main" switch in each school. All internet traffic comes back to central and out via a Watchguard firewall. Flat network, no routers other than the Watchguard. Would we benefit by adding a router to subnet our traffic?
Thanks

[Ron Kinner]

The problem with a big flat network like yours is that it is all one big broadcast domain. That means that any broadcast is sent to every one of your 1200 nodes which can cause a significant percentage of your bandwidth to be used just for broadcasts which could mean that your network might become congested and slow down. Are you getting complaints from users that the network is slowing down? (Slower printing or file transfers not slower Internet browsing which is another issue.)

A lot depends on whether you use netbeui, Appletalk, IPX, or TCP/IP on your network. The first three are very fond of broadcasts and can clog up a large flat network. It's easy to look at your network stats on your switch's ports and calculate the percentage of broadcast to unicast. There is a limit you can set which will keep broadcasts to a certain percentage which you might want to try before going to routers. You might also look into turning off netbeui (on by default in earlier Windows OS) and using only tcp/ip

A big router is not cheap and while adding it will solve your broadcast problem (if you have one) it may create other problems since certain services rely on broadcasts and they would have to be accomodated. Also there is the fun job of renumbering your network to consider (if you need to. Appletalk is automatic.)

Ron

[Charlie_12]

Wow! You must be using a class B network subnet i.e. 255.255.0.0 and can have up to 2046 hosts. Anyway... your 4000M's are switches, so broadcast traffic is already being kept to a minimum. I think we need more info about your situation. Does each school need to access each other, or only the resources of the central office i.e. internet connection, file server etc.? You could also section off your network into vLan's using existing features of your 4000M's or on your 4108 which would also improve internal security.
http://www.hp.com/rnd/products/switches/switch4000/overview.htm

[Russ_57]

First let me thanks Charlie and Ron Kinner for there responses. To answer Ron's question, yes we are starting to get complaints about slow downs at some times of the day. Your suggestion of calculating broadcast percentage is good, I will do it. As to netbeui, I don't use it now, but it is probably out there a lot, because of old installs.

Charlie's suggestion of splitting the switches into VLAN's is something that I thought about, but when I read the docs. It looks as though I would still to route, becasuse the vlans basically make the switch look like separate switches which will not pass traffic.
Yes we are using class b on our private network.

Any and all input is appreciated.
Thanks
Russ

[Ron Kinner]

If you can find an old NT box or maybe install LINUX on something you have lying around you could run MRTG and point it first at your 4108 then if you don't see the problem have it look at the individual switches and even the servers.

MRTG is a really neat network monitoring system. It polls the target device every 5 minutes and collects SNMP info which it then displays in a series of pretty graphs (which are just the thing to take to the budget committee to prove that you need a new router or a faster server or a faster internet link). By default it just looks at packets in and out on every port but with a bit of simple tweaking of the config files can get info like % CPU load, discarded packets and number of broadcast packets in and out. Best thing is it will certainly fit within your budget since it's a free download.

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

This is a much smarter idea than simply adding a router. You may still find that you need a router but MRTG may point out a simple bottleneck which will let you fix the real problem and not just shotgun it.

You might also want to look at a sniffer. There are some nice free ones out there. TCPDUMP is popular for UNIX systems. http://www.tcpdump.org/ but there is a variation called Windump for Window boxes. I like SNORT which is actually an intrusion detection system but which also does rules based packet sniffing. http://www.snort.org/

Be aware that with switches you cannot see all of the traffic on the switch unless you tell the switch that you want to. Something like Port Monitor or SPAN is usually what it is called. However, even without that you can see the broadcast traffic and get a list of the sources of the traffic so you can start killing off netbeui or whatever else is wasting bandwidth. (Compaqs all try to find a (most often nonexistant) central management facility by broadcasting on 2301. Even switches without an IP address assigned may contribute to the background noise by looking for a BOOTP or DHCP server.)

Ron

[OLARU Dan]

Russ
1.Download the latest firmware for 4108GL (g_07_21.swi) and 4000M (c_09_16.swi) from http://www.hp.com/rnd/software/switches.htm and install them on your machines.
2. Plan your VLANs: name them (for example VLN_172_16_10), define them on all your switches - even if you leave all your ports in DEFAULT_VLAN for the moment. Usually one VLAN is defined for computers in one physical location (like building or school), so you may want to to put all computers that reside in one school in one VLAN. If you manage 5 schools you should define 5 VLANs. Your VLANs can communicate if they all meet in a router or Layer 3 switch.
3. Subnet your class B network (probably 172.16.0.0) so you have all the computers that belong to one school (VLAN) in one subnet.
4. The up-link ports in all switches should pertain to all VLANs you setup.
5. Your DHCP server should be aware of the subnets you intend to use.

Charlie
Layer 2 switches will forward all Ethernet BROADCASTS (all switches are in a broadcast domain). They, however, manage to avoid Ethernet COLLISIONS, because every pair of ports in any switch acts like a bridge. You will reduce the broadcasts in your network only by using a correctly configured router or a Layer 3 switch.

Ron
The 4108s can act as a Layer 3 switch when running g_07_21.swi, right? So there's no need for Russ to buy a router, when he can have it by just upgrading his switch OS and configuring it correctly.

[Mark Landin]

Olaru,

Right, the 4108s can now be L3 switches. We are thinking of doing the same thing, but we are a bit leery since this is HP's first release of the firmware that does this. We don't have spare equipment to test with, so we're waiting for things to "simmer" a bit before we take the leap.