Hi @EricPerl 

Thanks for posting in our business forum.

EricPerl wrote

Hi @Clive_A , thanks for the reply.

 

I had not looked at that article. My humble network did not seem to require a proper data center network architecture 😊

 

I'll keep my remarks to things I've experimented with (I still don't know much about networking):

The article mentions implementing ACLs at the aggregation layer. I'm not aware of a way to indicate which switches should bother with "switch ACLs". It seems they apply to all switches at the site...

In fact, per my understanding (please correct me if I'm wrong), all switch ACLs could be enforced once at the edge, with the major major caveat that a switch probably does not know whether it is at the edge or not... so the ACLs are checked at all switches (tho denied packet don't make it past the first enforcement layer).

Also, I don't believe one has full native/tagged/untagged network assignment capabilities on the router LAN ports. In any case, the UX is not the same for these ports (no profile).

 

Which brings me back to an unanswered question: since the LAN ports of the router are switching ports, are switch ACLs evaluated there?

That would almost be easier to test in an environment without tp-link switches... Would traffic going through the router LAN ports be subjected to switch ACLs?

 

This said, the article had me question whether I should have plugged my "cave" switch directly in the router (the router would behave as aggregation layer).

All of my switches are essentially access switches but I've made my main switch (by the router) a hybrid aggregation+access.

I actually had done this specifically to not bother the router with LAN traffic...

I assume an ER605 does not need the additional burden and would make a poor aggregation layer even in a modest network (I and others failed to find actual switching bandwidth specs separate from routing bandwidth specs).

Yet another option (possibly the cleanest) would be to now make the main switch a pure aggregation switch (no clients connected, apart from OC). That would work in theory although I'm going to run out of ports again soon (up-link, OC, AP, 2 access switches => 3 ports left unused).

 

[ "acct" with one c goes against community rules??? replaced by behave...]

Technically all ports that are not marked as WAN are switching ports. I am only referring you to this knowledge but not meaning it will be classified into the SW ACL.

Do they all belong to the switch? Nope.

In the Omada Controller, the system still distinguishes the product by class. Not technically, theoretically, or terminologically.

Please do not try to be too literal and twist the meaning. Please make sure you understand the term and that we are on the same page so as to discuss this further.

Switch is a switch, a separate product with a different design ideology. Switching port means it is used for data switching but does not literally belong to the switch ACL which is a different concept of a product.

A switch contains switching ports but a router is not a switch but with switching ports because they are used for data switching.

Most concepts I bring up can be found with a Google search. It would be concise and easy to understand with several articles.

Regardless of what you have, if you follow the basic network hierarchy, you will have an uplink switch that populates other layers. The overall throughput will be no more than 1Gbps. 

Concurrent speed of the router should be enough for local switching. If NAT, that NAT throughput.

TBH, I find it hard to understand and follow some of your expressions. It's too personal. Not a general term which I think I can correctly grasp your meaning.

Follow the article and it will basically answer all of your questions. Regardless of whatsoever network you have, large or small, you basically still follow this principle of hierarchy because it is a universal principle and will not go haywire ever. All the problems with the switch are all coming from incorrect connections, poor network design and carelessness. 

It would not waste my time explaining this further as the guide has done that.

You can connect the switch and ports based on your preference as long as it works but if there is a problem, you should at least do a self-examine over asking because everyone would first point out your network design failure. You don't listen, then it is your job to fix it. Sometimes it is a problem with the design or hierarchy.

Just point out why it is important to follow the principle.