Date: Mon, 5 Apr 2004 09:18:16 -1000 From: Clifton Royston <cliftonr@lava.net> To: freebsd-security@freebsd.org Cc: Adrian Penisoara <ady@freebsd.ady.ro> Subject: Re: Q: Controlling access at the Ethernet level Message-ID: <20040405191815.GB17961@lava.net> In-Reply-To: <20040405190109.A9FB416A4D0@hub.freebsd.org> References: <20040405190109.A9FB416A4D0@hub.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> Message: 4
> Date: Mon, 5 Apr 2004 18:08:49 +0200
> From: Sten Daniel S?rsdal<sten.daniel.sorsdal@wan.no>
> Subject: RE: Controlling access at the Ethernet level
> To: "Adrian Penisoara" <ady@freebsd.ady.ro>,
> Cc: freebsd-isp@freebsd.org
>
>
> > What would you recommand ? Are there any other elegant solutions ?
> >
> How about using 802.1Q vlan's and dedicate a vlan to each port.
> If more than 4000 users then add more gateways.
>
> Just be sure to go for switches that allow you to deny incoming
> already tagged packets on the user side as some switches passes
> already tagged packets.
While this sounds theoretically like a good solution, in my
experience many midrange switches (e.g. HP Procurve 25xx and 40xx-
series) do not handle large numbers of VLANs well; they seem to consume
RAM and CPU roughly proportional to number of active VLANs, and past
some threshold you see packet loss.
As one of the constraints mentioned was "can't pay to add managed
switches" I would be cautious about this solution unless you *know*
that all the switches handle large numbers of VLANs well, or you'll be
trying to troubleshoot a network with unexplained and intermittent
packet loss. Just a warning from experience, FWIW.
-- Clifton
--
Clifton Royston -- cliftonr@tikitechnologies.com
Tiki Technologies Lead Programmer/Software Architect
Did you ever fly a kite in bed? Did you ever walk with ten cats on your head?
Did you ever milk this kind of cow? Well we can do it. We know how.
If you never did, you should. These things are fun, and fun is good.
-- Dr. Seuss
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040405191815.GB17961>