Training Capstone

Objectives

Learning network and server operations is best done hands-on and with practical objectives in mind. Set out to build something that you will use; learn along the way, check-pointing frequently with someone who’s gone before you. To help ensure your work is developing broadly marketable skills, a select set of training objectives is suggested. Your mentors should work with you to see that your project is exposing you to the different topics.

Assumptions

1. Residential network with a dynamic IP address.
2. An ISP-provided device can be placed into “bridged mode.” (Preferred, but not strictly Required)

Sample Deployment Options

Hosting

Networking

Networking Equipment

Since these are always-on devices in your home, the objective here is to have low cost, low power / heat / noise equipment that still provides capability equivalent to that found in small or medium sized businesses.

Typical home wireless firewall routers provided by the ISP or off-the-shelf at big box stores combine the following network functions:

1. Router: Moves packets between networks with a default policy to allow everything. In the simple case, this is moving packets between the home network and the ISP’s network, and vice versa.
2. Firewall: Applies rules of varying complexity to determine what is allowed to be relayed between networks with a default policy to deny everything.
3. Switch: Allows communication between wired devices and between wired & wireless devices on the same network.
4. Wireless Access Points: The radio devices that handle connections to and from multiple wireless client devices. (“The WiFi.”)
5. Wireless Controller: Coordinates the configuration and operation of one or more Wireless Access Points.

The home devices typically expose extremely limited feature sets (and sometimes substandard performance), and are simply not suitable for developing the skills used in professional environments. This is why professionals will often bypass their ISP-provided equipment in favor of their own gear.

Router / Firewall

Verify the firewall-routers can handle your network speeds. Ubiquiti’s EdgeRouter X provides a fabulous feature set for around $60. [I currently use an EdgeRouter X. My next will likely be a Netgate 2100.]

• Ubiquiti EdgeRouter-X / EdgeRouter Lite
• Netgate 1100 / 2100

Wireless Access Point (WAP) / Controller (WAC)

Ubiquiti currently provides the best, most afforadable “prosumer” wireless solutions. Ubiquiti provides their wireless controller as software without cost, and in most use cases it does not need to be run except to make configuration changes. This means that the wireless controller can be installed on a laptop in a virtual machine, for example, and brought up on the network for the initial deployment and for occasional firmware upgrades. These WAPs can typically be configured to handle up to four named networks (SSIDs), and each can be “VLAN-tagged” to help isolate and route the office, guest, and any other networks you’ve configured.

Note that WAPs are typically powered with “Power over Ethernet (PoE).” This means that the switch port feeding the WAP must provide PoE, or a “PoE injector,” a small box that adds wall power to the network wire, must be used.

• Ubiquiti U6-LR-US (~$180) is an advanced WAP implementing the latest WiFi-6 standard.

Also note: We can cannibalize old big box store wireless routers to provide wireless inside a VLAN at the cost of one box and one switch port per VLAN requiring wireless, though this is far from optimal.

Switch (if necessary)

Depending upon your network design, your Router device may have a sufficient number of ethernet switch ports to accommodate your needs. Unless the switch will be handling devices that all reside on the same subnet / VLAN, your switch should be “VLAN-aware,” which is to say that each switch port can be configured with a default VLAN and can be configured to carry traffic from selected other VLANs as well. If you are running wireless access points, security cameras, SIP telephones, or other devices that require power-over-ethernet, ensure that your PoE switch has enough total power as well as enough powered switch ports to meet your needs.

Note: Even if you don’t need a VLAN-aware switch, if possible you should own one and be familiar with using it to isolate traffic flow between boxes. It’s a fundamental skill for business networks.

Note: It’s likely that a switch with layer-3 routing is overkill and likely too expensive for household or small-to-medium–sized business use. It’s nice to have, but consider it low priority.

• NETGEAR ProSAFE GS108: A cheap, VLAN-aware, L2 switch. No PoE.
• Ubiquiti ToughSwitch. 5-8 ports, all PoE, each switch with various total power throughput, VLAN-aware, L2 switch.