Infrastructure/Case study 05
Network migration of a Zurich site
Replacement of the wired and Wi-Fi network of a site in Zurich: 10 Gbps fibre uplinks, many access points, centralised monitoring.
- Gateway
- Aggregation
- PoE switches
- Access points
- VLAN
- Site-to-site VPN
Scope
I replaced the wired network and the Wi-Fi of a site in Zurich, then linked it to a second site. The name of the site, the context and the detailed configuration are not published.
Architecture and uplinks
The network has three tiers: a UniFi gateway, an aggregation switch and two 24-port PoE switches. The aggregation switch is connected to the gateway and to both access switches by 10 Gbps fibre uplinks, which form the backbone. The access switches carry the ports for workstations, printers and access points.
Wi-Fi
The site has many UniFi access points, all powered over PoE by the two 24-port switches and managed from a single console. With that many access points, channels and transmit power are tuned carefully so that they do not interfere with each other.
Segmentation and inter-site link
Traffic is split into VLANs by use. A site-to-site WireGuard link connects this network to the second site.
Diagnostics
To diagnose a problem, I start from the uplinks: negotiated speed, errors, port state. Then I look at Wi-Fi quality access point by access point, then at throughput between the sites. The central console gives the overview, and a fault can be traced port by port.
Next step
An architecture for 802.1X port authentication has been designed for the next stage. A successful migration is mostly a network nobody talks about anymore.