ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Suggestions for new APs and Firewall

    IT Discussion
    8
    70
    4.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • scottalanmillerS
      scottalanmiller
      last edited by scottalanmiller

      You need to worry about traffic shaping when your high priority traffic is gaining unacceptable latency caused by low priority traffick saturating the outbound connection. That's it.

      DashrenderD 1 Reply Last reply Reply Quote 0
      • dafyreD
        dafyre @JaredBusch
        last edited by

        @jaredbusch said in Suggestions for new APs and Firewall:

        @scottalanmiller said in Suggestions for new APs and Firewall:

        @jaredbusch said in Suggestions for new APs and Firewall:

        @scottalanmiller said in Suggestions for new APs and Firewall:

        @jaredbusch said in Suggestions for new APs and Firewall:

        @scottalanmiller said in Suggestions for new APs and Firewall:

        @dafyre said in Suggestions for new APs and Firewall:

        @coliver said in Suggestions for new APs and Firewall:

        @dafyre they are certainly cheap enough.

        Yeah. If nothing else he could keep them around for places that need Wifi temporarily or something.

        My question is what Ubiquiti Router would you get for a campus with ~1200 people and a 500 mbit internet connection?

        Disclaimer: I used to work in the position that @Markferron now fills.

        ERL

        Number of users is really never a factor. Throughput is how you measure router performance, not user count.

        You obviously have not grasp of reality. I have posted more than one thread here about real world throughput on these units (because I love them and use the heck out of them).

        What are you seeing as a max throughput on the router functionality? VPN doesn't count.

        With any type of basic traffic shaping on the ERL your max throughput will be 60mbps.

        Yes, but we aren't talking about that.

        Yes, we are talking about that. Real world. Who runs a network with no traffic shaping on their edge router device?

        A college that has to prevent students from torrenting up all the bandwidth leaving none for important things like Facebook and Netflix.

        1 Reply Last reply Reply Quote 1
        • scottalanmillerS
          scottalanmiller
          last edited by

          This can happen with a single user at home, or not happen with thousands of users sharing a connection. User and device count just don't matter.

          1 Reply Last reply Reply Quote 0
          • DashrenderD
            Dashrender @scottalanmiller
            last edited by

            @scottalanmiller said in Suggestions for new APs and Firewall:

            You need to worry about traffic shaping when your high priority traffic is gaining unacceptable latency caused by low priority traffick saturating the outbound connection. That's it.

            Sure, of course... that could be the case with a single user.

            So if that's really the situation, then the answer to my question is - one.

            scottalanmillerS 1 Reply Last reply Reply Quote 0
            • scottalanmillerS
              scottalanmiller @Dashrender
              last edited by

              @dashrender said in Suggestions for new APs and Firewall:

              @scottalanmiller said in Suggestions for new APs and Firewall:

              You need to worry about traffic shaping when your high priority traffic is gaining unacceptable latency caused by low priority traffick saturating the outbound connection. That's it.

              Sure, of course... that could be the case with a single user.

              So if that's really the situation, then the answer to my question is - one.

              No, that's certainly not the answer.

              1 Reply Last reply Reply Quote 0
              • scottalanmillerS
                scottalanmiller
                last edited by

                The answer is... users aren't a factor. That's the only answer to your question.

                It's like asking "how many cupcakes does it take to get to the moon?"

                There is no answer, the question is just wrong. That you can get to the moon before you need to eat one cupcake isn't relevant as it isn't the cupcake getting you to the moon.

                1 Reply Last reply Reply Quote 0
                • dafyreD
                  dafyre
                  last edited by dafyre

                  This is for a school, not an SMB. With out some form of traffic shaping somewhere, their bandwidth would be overrun with torrents.

                  @Markferron can correct me if I'm wrong, but right now, I think the Meraki APs are where the bandwidth shaping is being done now.

                  scottalanmillerS M 2 Replies Last reply Reply Quote 1
                  • scottalanmillerS
                    scottalanmiller @dafyre
                    last edited by

                    @dafyre said in Suggestions for new APs and Firewall:

                    This is for a school, not an SMB. With out some form of traffic shaping somewhere, their bandwidth would be overrun with torrents.

                    @Markferron can correct me if I'm wrong, but right now, I think the Meraki APs are where the bandwidth shaping is being done now.

                    There is a lot more to it than that. How many schools have their phones via their public WAN, for example? They might, and then they likely need shaping, but the things that make you need shaping often go away when dealing with things like schools.

                    dafyreD 1 Reply Last reply Reply Quote 0
                    • dafyreD
                      dafyre @scottalanmiller
                      last edited by dafyre

                      @scottalanmiller said in Suggestions for new APs and Firewall:

                      @dafyre said in Suggestions for new APs and Firewall:

                      This is for a school, not an SMB. With out some form of traffic shaping somewhere, their bandwidth would be overrun with torrents.

                      @Markferron can correct me if I'm wrong, but right now, I think the Meraki APs are where the bandwidth shaping is being done now.

                      There is a lot more to it than that. How many schools have their phones via their public WAN, for example? They might, and then they likely need shaping, but the things that make you need shaping often go away when dealing with things like schools.

                      @scottalanmiller, I have worked at this place. They need shaping to prevent 3 computers with bit torrent from overrunning every ounce of bandwidth they have. Been there, done that, turned on traffic shaping, problem solved.

                      Edit: The Phone system is a different topic.

                      scottalanmillerS 1 Reply Last reply Reply Quote 1
                      • scottalanmillerS
                        scottalanmiller @dafyre
                        last edited by

                        @dafyre said in Suggestions for new APs and Firewall:

                        @scottalanmiller said in Suggestions for new APs and Firewall:

                        @dafyre said in Suggestions for new APs and Firewall:

                        This is for a school, not an SMB. With out some form of traffic shaping somewhere, their bandwidth would be overrun with torrents.

                        @Markferron can correct me if I'm wrong, but right now, I think the Meraki APs are where the bandwidth shaping is being done now.

                        There is a lot more to it than that. How many schools have their phones via their public WAN, for example? They might, and then they likely need shaping, but the things that make you need shaping often go away when dealing with things like schools.

                        @scottalanmiller, I have worked at this place. They need shaping to prevent 3 computers with bit torrent from overrunning every ounce of bandwidth they have. Been there, done that, turned on traffic shaping, problem solved.

                        Edit: The Phone system is a different topic.

                        Why not block those rather than shape?

                        JaredBuschJ 1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch @scottalanmiller
                          last edited by

                          @scottalanmiller said in Suggestions for new APs and Firewall:

                          @dafyre said in Suggestions for new APs and Firewall:

                          @scottalanmiller said in Suggestions for new APs and Firewall:

                          @dafyre said in Suggestions for new APs and Firewall:

                          This is for a school, not an SMB. With out some form of traffic shaping somewhere, their bandwidth would be overrun with torrents.

                          @Markferron can correct me if I'm wrong, but right now, I think the Meraki APs are where the bandwidth shaping is being done now.

                          There is a lot more to it than that. How many schools have their phones via their public WAN, for example? They might, and then they likely need shaping, but the things that make you need shaping often go away when dealing with things like schools.

                          @scottalanmiller, I have worked at this place. They need shaping to prevent 3 computers with bit torrent from overrunning every ounce of bandwidth they have. Been there, done that, turned on traffic shaping, problem solved.

                          Edit: The Phone system is a different topic.

                          Why not block those rather than shape?

                          In general, you cannot. Not without some packet inspection going on. and that again kill the CPU in the router.

                          1 Reply Last reply Reply Quote 2
                          • scottalanmillerS
                            scottalanmiller
                            last edited by

                            If you want to do all of this at the FW, which is reasonable but not the only choice, then yeah, obviously a bigger model is needed. If you are using the router only for routing, it will handle a lot of bandwidth. Just depends how you are setting it all up.

                            1 Reply Last reply Reply Quote 0
                            • dafyreD
                              dafyre
                              last edited by

                              If they wanted to block it all at the edge, I'd assume they would need to look at something such as a Palo Alto or what-not?

                              ER Pro -> Palo Alto -> Internal Network?

                              scottalanmillerS 1 Reply Last reply Reply Quote 0
                              • scottalanmillerS
                                scottalanmiller @dafyre
                                last edited by

                                @dafyre said in Suggestions for new APs and Firewall:

                                If they wanted to block it all at the edge, I'd assume they would need to look at something such as a Palo Alto or what-not?

                                ER Pro -> Palo Alto -> Internal Network?

                                That's one approach.

                                1 Reply Last reply Reply Quote 0
                                • scottalanmillerS
                                  scottalanmiller
                                  last edited by

                                  EdgeRouter have an option for blocking BitTorrent themselves. But they have to spend time looking at the traffic to do so.

                                  dafyreD 1 Reply Last reply Reply Quote 0
                                  • dafyreD
                                    dafyre @scottalanmiller
                                    last edited by

                                    @scottalanmiller said in Suggestions for new APs and Firewall:

                                    EdgeRouter have an option for blocking BitTorrent themselves. But they have to spend time looking at the traffic to do so.

                                    That's better done on a separate device, isn't it?

                                    DashrenderD scottalanmillerS 2 Replies Last reply Reply Quote 0
                                    • DashrenderD
                                      Dashrender @dafyre
                                      last edited by

                                      @dafyre said in Suggestions for new APs and Firewall:

                                      @scottalanmiller said in Suggestions for new APs and Firewall:

                                      EdgeRouter have an option for blocking BitTorrent themselves. But they have to spend time looking at the traffic to do so.

                                      That's better done on a separate device, isn't it?

                                      If that's the only thing you're doing - it is worth splitting?

                                      dafyreD 1 Reply Last reply Reply Quote 0
                                      • dafyreD
                                        dafyre @Dashrender
                                        last edited by

                                        @dashrender said in Suggestions for new APs and Firewall:

                                        @dafyre said in Suggestions for new APs and Firewall:

                                        @scottalanmiller said in Suggestions for new APs and Firewall:

                                        EdgeRouter have an option for blocking BitTorrent themselves. But they have to spend time looking at the traffic to do so.

                                        That's better done on a separate device, isn't it?

                                        If that's the only thing you're doing - it is worth splitting?

                                        They would likely benefit form the Web filtering and such on the Palo Alto (currently handled by the Meraki FW).

                                        DashrenderD scottalanmillerS 2 Replies Last reply Reply Quote 0
                                        • scottalanmillerS
                                          scottalanmiller @dafyre
                                          last edited by

                                          @dafyre said in Suggestions for new APs and Firewall:

                                          @scottalanmiller said in Suggestions for new APs and Firewall:

                                          EdgeRouter have an option for blocking BitTorrent themselves. But they have to spend time looking at the traffic to do so.

                                          That's better done on a separate device, isn't it?

                                          Depends. Blocking one service is a very minor thing and easily handled by the entry level enterprise non-UTM device. So likely, no, you'd not split for one little thing.

                                          1 Reply Last reply Reply Quote 0
                                          • DashrenderD
                                            Dashrender @dafyre
                                            last edited by

                                            @dafyre said in Suggestions for new APs and Firewall:

                                            @dashrender said in Suggestions for new APs and Firewall:

                                            @dafyre said in Suggestions for new APs and Firewall:

                                            @scottalanmiller said in Suggestions for new APs and Firewall:

                                            EdgeRouter have an option for blocking BitTorrent themselves. But they have to spend time looking at the traffic to do so.

                                            That's better done on a separate device, isn't it?

                                            If that's the only thing you're doing - it is worth splitting?

                                            They would likely benefit form the Web filtering and such on the Palo Alto (currently handled by the Meraki FW).

                                            Then you aren't doing just one thing of filtering out Torrents. 🙂

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 3 / 4
                                            • First post
                                              Last post