Q: Controlling access at the Ethernet level

[Clifton Royston]

> Message: 4
> Date: Mon, 5 Apr 2004 18:08:49 +0200
> From: Sten Daniel S?rsdal<sten.daniel.sorsdal at wan.no>
> Subject: RE: Controlling access at the Ethernet level
> To: "Adrian Penisoara" <ady at freebsd.ady.ro>,
> Cc: freebsd-isp at freebsd.org
> 
>  
> >    What would you recommand ? Are there any other elegant solutions ?
> > 
> How about using 802.1Q vlan's and dedicate a vlan to each port.
> If more than 4000 users then add more gateways.
> 
> Just be sure to go for switches that allow you to deny incoming
> already tagged packets on the user side as some switches passes
> already tagged packets.

  While this sounds theoretically like a good solution, in my
experience many midrange switches (e.g. HP Procurve 25xx and 40xx-
series) do not handle large numbers of VLANs well; they seem to consume
RAM and CPU roughly proportional to number of active VLANs, and past
some threshold you see packet loss.

  As one of the constraints mentioned was "can't pay to add managed
switches" I would be cautious about this solution unless you *know*
that all the switches handle large numbers of VLANs well, or you'll be
trying to troubleshoot a network with unexplained and intermittent
packet loss.  Just a warning from experience, FWIW.

  -- Clifton

-- 
          Clifton Royston  --  cliftonr at tikitechnologies.com 
         Tiki Technologies Lead Programmer/Software Architect
Did you ever fly a kite in bed?  Did you ever walk with ten cats on your head?
  Did you ever milk this kind of cow?  Well we can do it.  We know how.
If you never did, you should.  These things are fun, and fun is good.
                                                                 -- Dr. Seuss