Advice on Lan design for multi tenancy office

[Curiosityx]

Greetings, i have recently rolled out a scenario such as the one described above to a managed service office, all went smoothly but we have recently been approached by several companies wishing to do the same in light of the recent financial crisis more and more people are moving into rented office space instead of purchasing there own premises or taking out extended leases.

As such im trying to put together a template defining how such an office can be deployed in an efficient manner whilst providing concurrent voice and data services to tenants. Cisco CME w/ CUE or CCM /w Unity will be used for telephony services for all the office and of course isolation of data networks between offices is cruicial.


My current design encompasses the following:

10Mb/s Ethernet bearer /w between 4 and 10Mb enabled on the circuit.

Said connection terminates on a Cisco 1841 ISR Router which is in turn connected to the outside interface of either an ASA 5505 or 5510 dependant on the number of users within the centre.

The internal network consists of between 2-9, 48 Port PoE Cat3750 series switches depending on the number of users.

Anything upto 100 offices with between 2-10 people in each office each user is provisioned with a Cisco 7941G IP Phone that will also be used to handle wired desktop and laptop Ethernet connections.

Each office will be assigned a voice vlan and access vlan relating to the office number:

Eg: Office 21 will use Access Vlan 221 and Voice Vlan 321

Each will also be assigned it's own network for voice and data

Eg: Office 21 will use Data Network 172.31.21.0 and Voice Network 172.30.21.0

Now this is the part i am rattling my brains about in regards to how best achieve the end goal.

I want to allow complete separation of the data networks but allow each voice network to be able to talk to the other unhindered so that voice calls can be placed between offices.

For this i have two initial ideas, firstly create an inbound ACL on the switch and apply it to each Data Vlan preventing access from 172.31.21.0 /24 network then creating a less restrictive inbound ACL permitting SCCP, SIP, RTP etc then applying it to the Voice Vlans.

Internet access would be achieved by using a default route on the switch stack pointing to the inside interface of the ASA for example 172.16.1.1

Each office would also use the switch as there default gateway.

or

Apply the same ACL's as above and create a trunk between the switch stack and the ASA only permitting the DATA vlans on the trunk, then configure each office to use the ASA as the default gateway for internet access. This would give me more flexibility should an office not require internet access or for applying rate limiting etc.


So yes that’s where my train of thought is at the moment, any suggestions would be most welcome, I know what id like to achieve but am trying to do my best to keep it simple, stupid!

Regards

 

[bigredshark]

Having skim read, for seperation of data networks you may want to look at the Private VLAN or PVLAN config on cisco, it offers some of the abilities you're looking for and is much neater than ACLs. I'd probably go for this and put all the gateways on the ASA if I was keeping it simple.

Then swap the switches for 3560s as I can't see a reason to use anything bigger, you'll be able to do vlan based rate limiting on these if necessary as well.

Maintaining separate VRFs for voice and data is another useful idea if you want to have gateways on the switches after all.

I'm also not sure what purpose the 1841 serves??

 

[pdw8]

My current design encompasses the following:

10Mb/s Ethernet bearer /w between 4 and 10Mb enabled on the circuit.

Said connection terminates on a Cisco 1841 ISR Router which is in turn connected to the outside interface of either an ASA 5505 or 5510 dependant on the number of users within the centre.

Anything upto 100 offices with between 2-10 people in each office each user is provisioned with a Cisco 7941G IP Phone that will also be used to handle wired desktop and laptop Ethernet connections.

Regards

Depending on the amount of users I would probably say get a 100Mb bearer capped to the relevant bandwitdh, 100 offices with upto 10 people in each is severley pushing a 10Mb link.

I would also use a backup SDSL line connected into a WIC card on the 1841. Then have your provider use OSPF routing or something like that. I have even installed duel 2811 routers running HSRP for sites much smaller than your proposal.

As ever though it depends on budget. I honestly think getting a 100Mb bearer would be best long term, they take upto 6 months to install as it is and upgrades are not much less.

 

[bigredshark]

Depending on the amount of users I would probably say get a 100Mb bearer capped to the relevant bandwitdh, 100 offices with upto 10 people in each is severley pushing a 10Mb link.

I would also use a backup SDSL line connected into a WIC card on the 1841. Then have your provider use OSPF routing or something like that. I have even installed duel 2811 routers running HSRP for sites much smaller than your proposal.

As ever though it depends on budget. I honestly think getting a 100Mb bearer would be best long term, they take upto 6 months to install as it is and upgrades are not much less.

God, who are your providers, we're currently running 3 months for new BT and NTL circuits??

 

[pdw8]

God, who are your providers, we're currently running 3 months for new BT and NTL circuits??

BT and COLT mainly. I said upto 6 months, its generally quicker.

 

[Curiosityx]

Depending on the amount of users I would probably say get a 100Mb bearer capped to the relevant bandwitdh, 100 offices with upto 10 people in each is severley pushing a 10Mb link.

I would also use a backup SDSL line connected into a WIC card on the 1841. Then have your provider use OSPF routing or something like that. I have even installed duel 2811 routers running HSRP for sites much smaller than your proposal.

As ever though it depends on budget. I honestly think getting a 100Mb bearer would be best long term, they take upto 6 months to install as it is and upgrades are not much less.

I do see your point, should have been more particular, from the observations we have made so far internet usage is light. The offices are mainly geared towards telephony, the one we have already deployed has at the moment about 25 offices populated and ~150 users on the network, were only seeing at most 2Mbps usage on the 10Mbit link at peak periods, morning, lunchtime etc

We have also got to be aware of cost, yes the larger sites 100+ offices i would be looking at a 100Mbit bearer but the smaller ones it can be cost prohibitive, the managed centre's make most of there money on voice services through billable minutes not connectivity.

I realy do appreciate the advice though as it gives me a better insight as to how other people go about similar projects.

 

[Curiosityx]

Ive had several ideas thrown into the mix, one being that i use vrf-lite which is a good suggestion but would require the ip sevices image on the switches, the other which i was thinking of prior was the use of private vlans.

Would you guys say it is wise to use PVLAN's for the ammount of hosts im looking at supporting in these designs, each office would be on a seperate network still, or perhaps the use of multiple isolated vlans?

 

[bigredshark]

I think PVLAN is the best option in admin time requirements (setting up new clients etc) and simplicity. Thing is, you're setting up a fairly complex network here, so it's probably best done with a 6500 with the firewall service blade (yeah, I know cost is ridiculous but I'm just saying it's probably the cisco recommended way to do it). How often are you likely to be adding/removing clients from the setup or are you just planning to preconfigure every office and leave it as is as much as possible. That defines how it's best done in some ways as it'll govern how much admin work is involved.

 

[Curiosityx]

I think PVLAN is the best option in admin time requirements (setting up new clients etc) and simplicity. Thing is, you're setting up a fairly complex network here, so it's probably best done with a 6500 with the firewall service blade (yeah, I know cost is ridiculous but I'm just saying it's probably the cisco recommended way to do it). How often are you likely to be adding/removing clients from the setup or are you just planning to preconfigure every office and leave it as is as much as possible. That defines how it's best done in some ways as it'll govern how much admin work is involved.

If only they had 50k spend, then again that would be easy Umm yes my plan would follow similar lines to what we have already put in place at the existing site, offices would be allocated so many handsets and the network would be pre-built as per the customer requirements. This is mainly where im fiddling with different ideas on how to keep costs down but provide a smooth manageable service to the end user.

Im also trying to make best use of the hardware put forward for each scenario, i agree some aspects may not follow the letter of the law according to Cisco's best practises, it's bad enough at the moment with the dollar rate fluctuating, we are quoted a price one day the next it's gone upto £500!

If only i could get my hands on some spare layer 3 kit for a week!

 

[bigredshark]

Well if it's all pre-configured I'd go with either ACLs or PVLAN, PVLAN is neater I think but depending on how you do your sub-netting you may end up with uncomfortably large broadcast domains would be my prime concern...

 

[Curiosityx]

Well if it's all pre-configured I'd go with either ACLs or PVLAN, PVLAN is neater I think but depending on how you do your sub-netting you may end up with uncomfortably large broadcast domains would be my prime concern...

Indeed, my intial thoughts were to attach the ASA inside interface to the Promiscuous port, create a single primary vlan and then place each office in it's own secondary community vlan which should give me isolation between office's at layer 2 but internet access at the same time, as you mention i could use a single isolated vlan but then the broadcast domain would be getting quite sizable.

Do you know if i can assign different networks using DHCP to community vlans?

Regards

 

[bigredshark]

Indeed, my intial thoughts were to attach the ASA inside interface to the Promiscuous port, create a single primary vlan and then place each office in it's own secondary community vlan which should give me isolation between office's at layer 2 but internet access at the same time, as you mention i could use a single isolated vlan but then the broadcast domain would be getting quite sizable.

Do you know if i can assign different networks using DHCP to community vlans?

Regards

I don't unfortunately, I've just PVLAN in production once, to prevent hosts connecting to an ISCSI SAN from talking to each other. That's a more common use of PVLAN really.

However, if all the offices are on separate subnets, even if you use PVLAN you'll still be able to route between them via the ASA unless you apply appropriate policy on there. Given that, I'd almost be tempted to use ACLs on the switches.

It's a nasty little design problem you have there....

 

[Curiosityx]

It is indeed, most people seem to be split on how best to approach it, we dont have layer 3 kit in stock so im arranging to spend of couple of days with my disti to qualify all of the design ideas i have so far.

ACL's seem to be the easiest route however the idea of using PVLAN's is quite appealing providing i can get it to function in the appropriate manner.

At present im working down the lines of

Office 1

!
vlan 101
  private-vlan primary
!
!
vlan 201
  private-vlan community
!
vlan 101
 private-vlan association 201


Office 1 Switch Ports

interface FastEthernet0/1
 switchport private-vlan host-association 101 201
 switchport mode private-vlan host
 spanning-tree portfast
!

interface FastEthernet0/2
 switchport private-vlan host-association 101 201
 switchport mode private-vlan host
 spanning-tree portfast
!

interface FastEthernet0/3
 switchport private-vlan host-association 101 201
 switchport mode private-vlan host
 spanning-tree portfast
!
interface FastEthernet0/4
 switchport private-vlan host-association 101 201
 switchport mode private-vlan host
 spanning-tree portfast
!
interface FastEthernet0/5
 switchport private-vlan host-association 101 201
 switchport mode private-vlan host
 spanning-tree portfast


Office 1 SVI Interface

!
interface Vlan 1000
 ip address 172.31.1.1 255.255.255.0
 private-vlan mapping 101 201
!



Inside Interface of Cisco ASA configured as a trunk port


!
interface FastEthernet 0/13
 switchport trunk encapsulation dot1q
 switchport mode trunk

The only thing i havent investigated is whether i can set both the swithport access vlan and switchport voice vlan roles on the port.