IT Employment

Ask something
Discussion Locked

Planning new network - Help appreciated

0 helpful
4 replies

by utkcito

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello!
My name?s Uriel, and I?m appealing to the forum for some help and tips. I know the post is long? and I know I?ll have to research a lot in the net for info. But if you could help me get started and answer these issues and configuration questions I?d be VERY grateful. That way I can plan, prepare myself and buy in a smart way. Thanks a lot in advance!!!

I am a MD/PhD student and our lab is being rebuilt. The ?office? will be bigger and there will be room for up to 5 computer stations. Being the computers geek of the bunch, I?m now not only IT manager, but network admin too! I am kind of a windows expert (uh-hmm!), tweaking services and startups and registry and loaded with 10?s of utilities that do all I should ever need, etc, but my network experience is very small.

The cost of an internet point of access is 100$ per month, so the router will not only let us share the internet connection but also set up our local network for file sharing and central access. We will use wired since we don?t need wireless and laying the cables now is not a problem, and it?ll give better performance. We will carry over an old PIII computer and an iMac 17?, and we have a phaser 8200N network printer. We intend to buy 2-3 new computers as well, for a grand total of 6 connections as of today.
1st question: what is better, D-link (DI-808HV), lynksis (RV082) or netgear (FVS318)? All offer a 8 port router with VPN capabilities, as well as SPI etc. The three seem excellent, although I have a small tendency for D-link since they have a good local reseller and were very nice and helpful on the phone with my inquiries. Nonetheless, if one of the others is better I have no problem buying it.
2nd question: our net connection already lies behind the hospital?s firewall which needless to say is very very strong. The router has SPI and other filtering and management options which I will fine tune and maintain as needed. Will the individual computers still need a software firewall? Or will antivirus suffice? What about Windows XP Pro SP2 built in firewall + antivirus (and automatic updates across the board)? 5 firewall licenses renewed every year add to the cost, besides the antivirus which is beyond question.

Given that the computers are not personal, we want a central data storage. That way we solve the previous terrible problem of duplicate files everywhere and overall distributed junk. Applications will remain local, only user data files will be centralized. I intend to convert the old PIII to a file server. I?ll update the BIOS and install 512 MB of the fastest RAM that it accepts (is it enough?). I?ll leave the current HDD for the OS, and want to buy a RAID card that will give me SATA connections to use two mirrored 7200 RPM drives for maximum data integrity. Is this the way to go? Bear in mind that we don?t have huge files to transfer or access or even stream, but rather common files (word, excel, PowerPoint, pictures, etc). We do deal occasionally with relatively large image files when creating figures and posters etc. Will we have to copy those image files locally while working and then copy them back to the server or will the networked access be fast enough? Another question I have is regarding latency: will it be noticeable? Will there be noticeable delays when accessing, browsing and saving centrally located files? Is this configuration usable for four people working at the same time, assuming only one working with a big file? Will there be any trouble streaming music MP3 files to one or more clients while we work? I know that there is bandwidth to spare, but I don?t know the latency issues.
Another issue is the ability to record data to CDs from a client. Will it be possible? It is meant for regular backup and for distribution of information (that is, to hand to the big boss our work!). Will the CDR work just fine or do I have to restrict recording speed? Is there a way to instruct the recording program to create a local image first so that a network glitch won?t ruin the CD? Is it even necessary?

The PIII already has a network card, I don?t even remember if it is onboard. Assuming it is 10/100, should I change it anyway for a new one? Does it matter if it is onboard or not?

Now a central question: can I use windows XP Pro on the server or should I buy the server edition of XP?
From what I know, I thought about this network scenario: every client computer has one local login, a general user login for everyone to use (of course it is not an admin login) with all the apps etc available. In order to access the data files the user would have to ?log in? into the server remotely. After 20 mins of inactivity the connection is severed. I don?t care if someone leaves the clients open since there will be only apps there (should I care?), but I don?t want strangers to be able to access data of a user who ?forgot? to log out (as we all know, nobody logs out?). Will the server know not to cut the connection after 20 mins if a file is still open remotely, even if there was no activity (say it is being worked on but the user hasn?t saved in the last 20 mins)?
In the server I?d create personal folders and specify for every folder access rights: admin, certain user, all users, etc. I don?t need quota management. Is this the way it should be configured? Or is it done this way: every user has a login which he uses to access whatever client computer he is using and he is automatically connected to the server and the server?s drive is mapped locally? Which one is better? Which one requires the most management? Which one can be done in plain XP Pro and which one needs a server OS? Or am I completely lost and the network should be configured completely differently? Will I be able to do it or we?ll need a VAR to set it up?

Another central question is how will I restrict who has access to the server? Can I do MAC filtering at the router level and that?s it? Will the router keep the local IP addresses of the computers static? Even after turning on and off the router or the server or the clients? or after being connected/disconnected from the external network or being assigned a different IP? The server of course will not be a working station, but how do I have to keep it running (assuming I?ll be using XP Pro)? logged in as admin, user, or will it work without anyone being logged in? These issues are important for security and maintenance issues.

Simple question: are there network scanners? We want to buy one, and I was wondering if I can attach one to the router for everyone to use. If not, should I connect it to one comp and anyone that whishes to use it will have to work on that computer, or should I ?share? it? Is this a problem?

As I said, we have a Mac (OS X 10.2, fully updated). How will it behave in the network? Will it be a hassle to connect it to the windows server? Does it matter for the Mac if the server OS is plain XP Pro or server version? What about an antivirus or firewall? Do I need one? Right now the Mac is standalone, so it doesn?t have AV. And regarding local vs distant files: will it work just fine? Are the file systems compatible at that level ? using excel for instance in the Mac to work with the central files? That way the Mac would count as another working station. And a last question: we have in the Mac a special OS 9 application (which is the reason for us having a Mac altogether, and the reason we cannot upgrade to OS 10.3 since it doesn?t work in it). Can I store the user files in the server as the other ?normal? files, or should I leave them in the Mac? Since we can work on them only in the Mac the centralized storage is not such an issue for those files. It only makes backup and file access rights easier (user rights and file ownerships is such a hassle in the Mac!).

And, alas! The last question: VPN. Will we be able to use it to connect to our files from home (or abroad) through the internet? The catch here is the hospital?s firewall. How does this work anyway? When I want to connect to the router from outside, do I need to know its IP? Or what?

Thanks again everybody,

Uriel.

4 replies

by bhalverson

Uriel,

The number and scope of your questions require answers that "paint in broad strokes" and make certain assumptions. However, I have had the opportunity to install networks, servers, workstations, routers, firewalls, VPNs, Anti-Virus solutions, etc. for all industries, and in particular, health care clinics and hospital radiology departments. My company routinely does this sort of thing, so I'll take a crack at answering some of your questions. First, I have to get the legal aspect out of the way: I make no warranties nor assume any liability for the use and/or applicability of this information for your particular circumstance.

Answer to Question 1: You mention three vendors - is there a reason for this limitation? Is it price? I have owned and installed products from all three vendors. I have installed several Netgear FVS318s for small companies. I like them, and they offer nice features at a good price. I get mine through CDW. I don't recommend Linksys. I have grown tired of problems with Linksys products. I was hoping that Cisco's purchase of Linksys would improve things, but it doesn't seem that way. In my opinion and experience their customer support is below par. D-Link in my opinion has always meant "cheap", and not in a good way (Although I am a proud owner of a D-Link 24-port managed switch). If you get a Netgear, update it with the latest production firmware from the website before you configure it (you have to clear the config anyway after the upgrade). A more robust solution, of course, is a Cisco PIX 501 or above and a separate Ethernet switch, which I prefer in a health care setting. Of course, the configuration is more difficult, but not impossible.

Answer to Question 2: You talked about an Internet connection, and then you mention the hospital's network. I would need more clarification on this to give you an answer. Are you going to have to connect to the hospital's backbone network to share files or other application data, or is none required? Is the Internet connection in your department the only outside connectivity required?

Your next questions kind of streamed together, however, in terms of a central file storage, Macintosh file storage, etc., and all of the things that you mention, and an eye toward ease of use, learning curve, etc. Microsoft's Small Business Server 2003 Standard Edition seems like a good choice. Again, this assumes that you do not need to share files with the rest of the hospital, nor join their domain. It is $599 retail with 5 CALs. You will likely want a network card capable of 100Mbps Full Duplex - verify the NIC on the PIII meets that criteria. 512MB will likely be enough, if that computer can hold it. What speed is the PIII? You will also likely want a backup solution that is automated from the server. CD-R backups are OK, but can be a pain and take time away from other job-related tasks.

You can restrict access to the server through User IDs, not by MAC or IP address filtering. You can configure group policy to automatically lock the workstation with a password protected screensaver, and you can restrict logon hours through the User ID.

You will want Anti-Virus for all of the computers (server included), and Norton Anti-Virus Small Business Edition, 5-user edition seems like a good choice. In general, with the workstations behind a hardware firewall, a software firewall is not necessary, and only manages to slow down the responsiveness of the workstation. That includes Microsoft's Windows Firewall. Again, more information is necessary regarding the connection to the hospital's backbone network...

Network Scanners - hardware research and specification would be required. Offhand, I believe I have heard of such a thing...

A lot of the solutions to your questions regarding responsiveness have to do with the interaction of many variables, and some more information would be required to get a big picture viewpoint.

VPN connectivity answers depend on the answers to the question regarding connectivity to the hospital's backbone network, and of the firewall selected... In my experience, it is possible either of the two ways.

So the short answer is that it looks like you can build the network you need to meet your requirements. Of course, more specific information is needed.
If you want to pursue this further, I invite you to e-mail me at brian.halverson@viapulseconsulting.com. The project planning and configuration specifics may be more than what you could expect from a free forum site, especially because once you start talking in real definitives with a solid network design and project plan, responsibility and potential liability come into play.

Brian

by utkcito

Brian:
1st of all thank you very much for your answer and the offer to help. Since posting the original post I have advanced, mainly through internet research and other sites I posted to.
I will clarify things in order, and tell you the current issues at hand:

1)I am a PhD student, who happens to be a computers 'geek'. That means I am enjoying the stuff and will enjoy the challenge of installing, configuring and making our labs net rock. But afterwards, I want it to work alone and let me do my real work!!! So ease of administration and maintenance are central to the net configuration - I will not be a dedicated admin, but will admin it "by the way".

2)The hospital will be for all purposes an ISP. We are a research lab, so we don;t need access to any hospital resource except internet access - we don;t log into a domain or anything, we get a wall jack with a static IP number with internet access (we do sit behind their ultra strong Firewall). One reason for creating this subnet is because the hospital charges us 100 $ per month for every such wall jack with internet access, so now that the lab is being reconstructed and reconfigured we are adding computers and plan to share one such internet access point to reduce costs.

3)The most important characteristics the net must have are 'remote' file access almost as fast as local (=latencies as low as possible) and long term existence. This net should last years without much change.

4)The network will be P2P since I do not intend to create and manage a client server architecture. Since we are behind the hospital and the routers' firewall, security is not such a concern - usernames, good passwords, good backup schedules, antivirus everywhere and we're set, plus the occasional spyware search tool. I intended to use win XP Pro but you mention SBS 2003. What advantages does it offer? I actually like the XP Pro idea since it could be used as an extra station in case of need - one client being down or many people working at once, etc.

5)The workload of our group is typical office work (word, excel, PPT, web, acrobat reader, email) with light image work (scanning, cropping, small adjustments, etc) with local programs and remote file storage. In order to avoid people saving their files in a client I need the latencies to be low so they can browse their server folder fast enough for it to be convenient. The network will be all duplex gigabit as well, to reduce latencies, be prepared for future applications and overall long term work with minimal further changes.

5)I ditched using the old PIII as server, and instead one of the new computers will be the server, again striving to give fast access to server storage. Since the PIII can do most of the client side work good enough, I only have to upgrade its NIC. One of the new computers will be configured as a server. Athlon XP 2800 or better, 1 GB RAM. Now the first question: which components are important to reduce as much as possible server side latencies? I do not know if a server class motherboard is necessary or a desktop type high end motherboard would be enough. I plan on SATA 10000 RPM main HDD + a 2ry 7200 HDD for daily backups (monthly backups to a CD-R / DVD-R). Mirroring is needles since we are not mission critical and if the main HDD fails for some reason we can do for a couple of days with the slower HDD until we get a replacement. The data lost for one day of work since the backup is not an issue. A stripping configuration is overkill I think. I intend to buy as well a server-class gigabit NIC. the hospital has of course fail over power, but nevertheless i intend to buy a UPS for the server for the added surge protection and voltage stabilization. I also witnessed a power outage, and the fail over is not immediate but rather an "on - off - on again" thing.

6)I also ditched buying a router/switch for buying a router and a switch. it's just better in every possible sense, and the price premium is not that big. It'll be an 8 post switch (1 server, 1 net printer, 3-4 clients). Since the effective bandwidth is restricted by the server to switch connection, which consists of a single gigabit NIC, I do not need a non-saturating switch, do I? Any data arriving at the switch in excess of 1 gigabit (not that we have such requirements) will have to wait anyway, so I don;t need a switch that is capable of more than that. It did show up in a discussion that a switch with low latencies is a good switch so it'll be non-saturating anyway. How are these specs marketed, specified by switch makers? I need a switch with fast internals but not necesarily wide bandwidth.

7)is client side NIC a latency a bottleneck as well? is an onboard NIC OK or should I buy add-in NICs?

8)Other thing I need to address is if I should use DHCP or static IPs. I lean towards using static IPs, I think it is more demanding at the beginning but afterwards I can sleep quietly. it also allows for more control when adding/troubleshooting things I think. It also helps security wise, but as said it is not a real concern. In a static IP scenario, how would a laptop configured when plugged in occasionally? Are network printers able to work both ways? More to the point, can DHCP and static IP configurations live side by side? In case of DHCP, who gives the IP numbers, the router or the server? (I think the router). where does MAC filtering enter the picture? is it needed or does it solve or improve anything in my case (I am guessing not). and lastly, which solution will yield the best performance and easier administration?

9)cabling: cat5 or cat5e? what's the difference for me? I know cat5 is needed for gigabit, but i haven;t been able to find out what does the 'e' add.

I have a Macintosh to connect as well, but that i'll leave to the appropriate forums, they'll know the answer in a second. That's the beauty of the mac, they are all the same. that's also it's main problem!

Once again, thank you a lot!!! I hope I am not abusing your kindness...

Uriel.

by tech277

Uriel,

I did check out your situation and I can offer a little help.

With your network configuration, you had mentioned Cat5 vs. Cat5e. Let me assure you that for the needs that you have specified, Cat5e will work fine. I'm a little confused as to what you need the cabling for (are you talking patch cords to link up to the switch?), but Cat5e will work fine.

Regarding latency and lag issues, for the small number of clients that you have in the subnet, there should be latency and lag should not be noticable unless you have everyone streaming MP3's at the same time which will suck up your bandwidth noticably.

A typical 10/100 Ethernet NIC should be sufficient for all of the client pc's.

I would stick with Windows 2000 server for the server OS only because it seems to be the most reliable (from my experience) and Microsoft has had a few years to work most of the bugs out. 2003 server is still a little iffy if you ask me.
Also, XP Pro for the client OS will work well with no flaws. Beware XP SP2.

Gotta run....good luck
JB

by ccotter

The first thing to grab my attention is that you state "The network will be P2P since I do not intend to create and manage a client server architecture." When indeed, every aspect of the configuration you mentioned is Client-Server architecture. I think this is a better way to go anyways, I setup 4-15 man shops all the time, everytime I put in a server machine, configured right, this pretty much allows me to "Set it and Forget It"...
Reasons to go Server-Client:
1)Centralized logins (If you go P2P every person you want to give a unique login to will need to be created on all the computers, very time consuming)
2)Centralized maintenance (files, login scripts, antivirus)
3)Domain Creation-with a domain in Windows 2003 you can create Group Policies these alone will save your administration time hours

Now as far as antivirus:
Several may laugh, but I only install Panda Antivirus, get the business edition for Windows 2003 server and 5 client seats...then you can just push it down to your clients and keep them updated from the server.

I know you had TONS of questions but I am not sure what you have answered on your own in the past few days...drop me a line if you would like chet@mycheetah.com. Be glad to help...

Also have you thought about a WAP along with your network, that would allow future laptop owners to join the domain without the need for additional cabling (if they had the right credentials) Okay, will talk to you soon, Good Luck...

This discussion is closed to new replies.