BrandonB's questions

I have a Asterisk box actually two running pure asterisk. No GUI i.e. FreePBX, TL etc. The asterisk box is connected to a an EX4200 VC Stack, the EX4200's then connect to our headquarters via a Qwest Metro Optical Ethernet line or QMOE. All it is for those not familiar with it is a very expensive site 2 site VPN. It terminates to our EX2200 PoE's switches in HQ.

Now the problem is that QMOE will not recognize any VLAN,DSCP tags. This line will be upgraded but unfortunately in our datacenter they will have to change the drop to fibre increasing the price and surpassing our budget for this year.

My question is this, I would like to get as much QoS as possible. Not having a MPLS line to HQ is a huge handicap but, can I do anything to make sure that SIP is receiving the most stable bandwidth ?

My thoughts have been :

1) ACL / Firewall statements stating anything from 10.10.0.35/32 gets the "expedited forwarding"

2) Local switch VLAN's, meaning just a VLAN local to the EX4200.

3) Or both let me explain :

I setup a port based VLAN 100 on the upstream EX4200's, those ports are connected to the LAN of the PBX's. Asterisk is passing or setup for VLAN 100. Now I tell the EX4200 that VLAN 100 is the "Voice VLAN" this should isolate it from server traffic. When data is sent to HQ, the EX2200's see that it coming from IP 10.10.0.35 and place it in VLAN 100 assigning it "Expedited Forwarding".

A few questions on this, Am not sure if the EX2200's can do VLAN placement, I am running firmware 10.4r5. If they cannot can I just do a simple statement on both ends saying anything for the PBX's IP or MAC gets "Expedited Forwarding" ? Asterisk / SIP is so sensitive to network configurations I need to make this as clean cut as possible. I do not need the IP-Phones to be on a different subnet. All I really want is anything coming and going from/to 10.10.0.35 to receive priority. If there are any JunOS experts do you think you could show me a simple statement to get me going in the correct direction ?

This is been confusing me, I need to demo a controller failure. The PS4000 will only kick over to the secondary controller on physical failure. So link state will not work. Other that me tearing into the SAN and disconnecting the controller is there any way I can prove this for my peace of mind ? or do I just throw it into production hoping Dell did a good job on the Q&A ?

I have a new ex4200 switch stack, my 3 esxi hyper-visors connect to the SAN via vlan 200 which is EST. I have loaded the Equallogic multipathing plugins. When I have the 4 cables per server dedicated plugged in to the switch the hyper-visor see's 4 paths like it should. When I lag 2 ports and 2 ports together I only get two paths. This is expected behavior however what is better ? Use 2 2g links dictated by the switch or use 4 paths and let the plugin do it's job ?

So this is my new "project" which consists of tearing down our legacy network and re-doing it correctly. As of now it is a mess. Production is a hogpoge of legacy servers that should have been put to pasture two years ago. Within this time period I got my VCP, which is good but I do not know all of this by heart. This is my first network / server revamp. As well as my first non-lab vSphere work, actually I have never logged into a SAN up until a few weeks ago when we received our PS4000 At this point am breaking this project into design phases so the first one up is the VLAN, Switching layout. I have attached my spread sheet with vlan id's, subnets, use and switch ports. I have read allot of best practices but, it is starting to just melt together. If i could get any advice on this I would very much appreciate and, please feel free to rip it apart.

VLAN Assignments Rev.1

http://dl.dropbox.com/u/6674806/Copy%20of%20Production%20VLAN%20Port%20Assignments-1.xlsx

Kind Regards,

Brandon

VLAN Assignments Rev. 2

Uploaded a updated version per advice.

Am deploying and designing a new network for our sourly damaged design. I have never designed a network from the ground up, by my self. The simple run down is this :

• VLAN 1 - Production at the data-center. 10.10.0.0/24
• VLAN 2 - Normal Users 10.10.20.0/24
• VLAN 3 - IT 10.10.30.0/24

• VLAN 4 - Voice 10.10.40.0/24

  1. One DHCP Server ( 2008R2 )
  2. Two Juniper EX2200 PoE in a stack at the local office.
  3. Two Juniper EX4200 in a stack at the data-center.

The issue I am confused about is I don't want to allow normal users accesses to prod. but, I need to allow them accesses to exchange, citrix, IM and a few other servers that are classified as production. How do people normally do this ? Do I just assign there port access to VLAN 1 that kind of seems like am defeating the purpose of having them or do I separate the servers that are needed by normal users and put those in VLAN 2 ? My last thought is do I only allow them external access to exchange i.e. RPC or HTTP ?

Thanks guys

I am really stumped on a new infrastructure design. Let me explain our scenario. I have been tasked with the complete rebuild of our network infrastructure.

The requirements are isolation of our production, dev/it, utility/test, iSCSI, and just office users traffic. The problem I am stumped on is dynamic DHCP.

Let me explain this.

I am located in the exact same office as our normal users, along with our dev team. I do not want to allow normal users access to our production machines via a LAN IP address except for domain controllers and our exchange server. I need however to allow access to IT/ Dev. Each VLAN will have a separate subnet and all of our switches are L3. My core switch will be a Juniper EX4200 stack and our switch at HQ will be a Juniper EX2200 POE.

I am pretty sure this can be accomplished a few ways but, management seems like it could become a beast. Some Ideas I have thought of:

1) Have multiple DHCP server scopes and restrict per mac address by statically entering MAC address.

2) Statically set IP address for DEV/IT

3) Possibly have the switch hand out DHCP

None of the above seem like good options however. It seems like am missing something very simple but, I just do not know what.