A while back I made a video about how to plan a HomeLab, and if I can summarise the advice I gave in
one sentence it would be: "Build something that is representative of an enterprise IT environment so
you can learn how it works; but don't spend enterprise money to do it." Now this advice
works great for servers because servers are just computers. You can install a server operating
system on an old laptop and it'll work just fine, but the same thing can't be said for networking.
You can't just take a random consumer grade switch like this and make it run spanning tree; so when
FS.com got in touch about sponsoring a networking video, I saw an opportunity. They're well known for
making network equipment like SFP modules that are compatible with the big enterprise vendors
like Cisco and Juniper, but much cheaper; but they also sell switches. So I set them a challenge...
"Show me something with enterprise-grade features that is actually affordable for a regular person."
"Oh, and we don't all have a dedicated server room for our HomeLab, so it also needs to be silent!"
Welcome back The Pro Tech Show. This video is sponsored by FS.com but before we look
at what they sent over let's talk about the three categories of switch you might consider.
Those are managed, unmanaged, and smart managed.
Unmanaged are just dumb switches. You plug in some cables, and network happens. They're the type you'll find
on most home networks because they're really cheap and there's zero configuration required.
You just plug them in and you're done! Managed switches are way more intelligent. When you think
about an enterprise switch you're thinking managed. They have a whole host of security, performance, and
monitoring capabilities to craft and protect your network. They are computers in their own right and
can provide basic network infrastructure services such as DHCP and time synchronisation that you
might traditionally run from a server, and they can act as enforcement agents for security policies.
As for smart managed? That might sound like it's the next tier up but they actually sit
in-between managed and unmanaged switches in terms of both price and features. Sometimes they're just
called smart switches. They provide very limited configuration options compared to a managed switch
but they cover a lot of the basics you'll need in a small business network, like VLANs.
They're a compromise, but can be a useful one. A managed switch tends to have a complicated command
line operating system to learn. A smart switch by comparison can fit its more limited features
within a basic web interface so they're easier to pick up and use with relatively little experience.
You're probably wondering which type of switch you should choose for your HomeLab... Well, don't get an
unmanaged switch. As a bare minimum you want VLANs. With an unmanaged switch every cable you plug into
your switch gets put into one big network. VLANs let you chop up your switch into lots of different
networks. You can create four VLANs and it's like having four separate switches. There are loads of
reasons you might want to create multiple networks. You might want separation between your home
network and your lab. You might have IoT devices that you want to separate from your more sensitive
devices. You might want to learn about firewalls and routing, or install something like pfSense.
You might be publishing services to the internet and want to put them in a DMZ. That's like five
different networks already! It's easy to create virtual networks inside your hypervisor and drop
virtual machines into them, but as soon as you want to extend that to the physical world you need a
switch. If you have five networks you need five switches. You also need five network interfaces
on your host server, and things starting to get out of hand. With VLANs you can divide one switch into
five. You can configure a single port to act as a trunk between your switch and your host,
and your host will then send all the traffic down that same cable but tag each packet with the VLAN it
belongs to. When it arrives at the switch it will read the tag and put it into the correct network.
Trust me: you want VLANs. That narrows us down to managed or smart managed switches. What I did was
I bought a smart managed switch. My logic was that if I could create VLANs and trunk them to my host
then I could play with all the virtual machines I wanted and connect them up to the real world.
What else do you need? I... regret that decision. All of what I said held true; but a lab is for
learning and there have been a number of times I just found myself stuck because I wanted to play
with a technology that needed more from my network than the smart managed switch could provide.
Like authentication. It's pretty standard that you'll need a password to join a wireless network,
but get a cable plugged in and you have access to everything. Not great in publicly accessible
buildings or areas. It doesn't have to be that way. With a managed switch you can have the switch
block access until the client has authenticated. You can even require them to meet policy checks
like making sure their antivirus is up to date. Do I need this at home? No; but I want to learn how it
works. Or even things you might take for granted, like monitoring. The smart managed switch I had
was a fairly inexpensive one (it wasn't FS.com just for the record). It looked the part but man it was
buggy! I went through several firmwares where it would just randomly lose parts of its config (and
no I didn't forget to save it). It would have been nice to at least get alerted that something was up.
It would have been handy to integrate that into my regular backup routine. But smart managed means
you've just got a web interface; so no access to the filesystem, no access to the command line,
no automated backups. If you just want it to do one thing and it happens to support that one thing,
great. But if you want to experiment and learn it becomes limiting, quickly. So my advice is
that at a bare minimum you need a smart switch, but if you're interested in learning about the
network side of things then you really want to try for a fully managed switch so you're not
limiting your ability to tinker and learn. Which brings us to this! This is what FS.com sent over.
It's an S3910-24TF. Catchy name, right? It has 24 standard RJ45 ports and four SFP ports, all one
gigabit. It's got the 802.1X authentication I was looking for. SNMP, RMON, and syslog for monitoring.
You can use it as your DHCP server, your time server, or force people to authenticate in a
web browser before they're allowed access to the internet or sensitive network segments.
It has port mirroring. It does inter-VLAN routing. It's stackable. It has high availability features
like the virtual router redundancy protocol. Look, I'm not going to spend the rest of the video just
listing features because that will get tedious very quickly. Have a look on the website, check the
manual... by the way that manual is detailed! There are literally thousands of pages of documentation.
If you look up RADIUS in the configuration guide it doesn't just tell you how to configure it on
the switch. It tells you how the RADIUS protocol works. This is a useful reference even if you don't
use an FS switch. The best part is it does all of this whilst remaining completely silent. I used
to have a second hand Cisco switch at home and it was noisy. That's why I stipulated to FS that this
needed to be quiet; because if you're using in a HomeLab your family might not appreciate the
constant home of fans. The S3910 model they sent is fanless, which ticks the wife approval box;
and also... hey, if it doesn't require active cooling that's generally a sign it's not consuming tons of
power, and with energy prices these days I don't need a switch burning through my bank account!
I'm not going to do a bunch of performance testing on the switch. I'll put a link to
the Ixia report in the video description if you want to see the latency and throughput numbers
because there's not a lot I can add to it. Instead, let's take a look at the management side of things,
and how you could start learning with it. There are two ways of managing the switch -
the web interface, and the command line. The web interface is accessible using HTTP or HTTPS.
The command line is successful using SSH, Telnet, or a console cable. The web interface is an easier
learning curve but it only gives you access to a subset of the features. It's kind of like using the
switch as a souped up smart manage switch where you click on icons in the browser, but you don't get
access to everything. You do get more than a smart switch would give you but for ultimate control
you'll need the command line. The way I would approach this is to start with the web interface.
What you can do is click your way through the options in the web interface to configure
something, then inspect the configuration you generated to see what it actually looks like.
That's a good way to learn about the capabilities of the switch, as well as start learning about the
command line; because a lot of the config that gets generated is basically what you would have typed
into the command line. The best way to show you this is to show you, so let's set up some VLANs.
I've reset the configuration for this demo so don't get too excited when you see passwords
and suchlike in the config, OK? I knew this was going on YouTube when I recorded it. When you log
in you'll see this status dashboard. To get to the VLANs we're going to go to favourites then VLAN.
We've got a default VLAN with ID 1. Let's edit that and call it our "internal" network.
Now let's make a new VLAN with ID 2 and name it "internet". We'll select ports 2 and 3 and click Save.
That's it. Now let's take a look at the configuration that generated. There are a
couple of places we can see it. The first is in the web interface. We can go to System, Settings,
Reset... yeah, be careful in here, OK? If we click the Display Current Configuration button it gets
listed in here. Not the easiest way to read it but you can select all and copy it to a text editor. The
other way we can see this is in the command line, so let's take a look at that. I'm going to do a bit
of movie magic here because you know how I said I wiped the config and took this off my network?
I recorded logging into it first so I could show you this. So this bit is from an alternate timeline.
I just thought it was cool. Here I am logging into the switch, and what's this? A mobile app prompt?
Remember my video about secure remote access for openHAB? I had the servers still lying around from
that one so I hooked the switch up using RADIUS for authentication. In the corporate world you'd
do this to provide centralised access control and auditing for your network infrastructure.
In my case I just thought it would be fun to show multi-factor authentication on a command line.
Let me know if that's something you actually use. If someone gets onto your switch and changes VLANs
about they could drop themselves into a different network so it could definitely be used for lateral
movement. Then again if they can actually get onto the management interface you're probably
in trouble anyway. Let me know though - I'm curious if you do it. Let's jump timestreams again and
back to our sanitised switch we just added our VLAN to. We can show the configuration directly in
our command line by typing "show running-config". You can see our internet VLAN right there. Let's open
another connection and create another VLAN. This time we'll do it in the command line but we're
going to use the configuration we generated in the web interface to guide us. Type "configure" to enter
global configuration mode and then we're going to copy the config from the left side of the screen.
Literally just type the same thing and change the number: "vlan 3". You'll notice our command
prompt has changed to show we're now working on a VLAN. If you look back at the config you'll notice
the name of the VLAN is indented. That's showing the same thing. The name is indented to show it's
configuration within the VLAN. Our command prompt is changed to show we're configuring within the
VLAN. So copy the next line "name" and then we'll call this VLAN "DMZ". Now if you want to jump back
up a level to get to our global configuration mode we can type "exit". That's our VLAN created.
Now we need to assign it to a port. Same again: copy the config we already made using the web interface.
Let's assign it to port 4, so "interface GigabitEthernet 0/4". The command prompt has changed again -
we're now configuring the interface. Look at the indented line in the configuration:
"switchport access vlan" and then "3" to assign VLAN 3. "Exit" to go back to global configuration. "Exit"
again to get out of configuration mode and back to exec mode. Now if we do "show running-config"
we'll see our new VLAN configuration, just like the ones we configured in the web interface.
In fact if you refresh your web interface now we'll see our new VLAN showing up.
Now I could have read the documentation and that's obviously a very good thing to do,
but i think this is a great way to teach yourself how to use the command line. If you've not worked
with switches before, one thing you might not be aware of is that if I reboot the switch right
now all of that config will be lost. By default any changes we make are applied to the running
configuration in memory, but they're not saved. To save it we have to enter the command "write". This
is a handy "Get out of Fail Free" card because if you're making a change, just don't write the config
until you're sure it's working correctly. Test it first. That way if something goes wrong and
you're not quite sure what the problem is you can just reboot the switch to undo all of your changes.
Point of note, though: any changes you make in the web interface are saved automatically. You can't
just reboot to undo those, so have a backup and try not to lock yourself out. One thing you may have
noticed here if you're familiar with Cisco's kit is that the commands probably looked very similar.
Yeah, I could make a joke about it but honestly it just makes sense. Cisco is the big dog and there's
a pretty sizable industry built around their training and certifications. Why would you try
to compete with that when you can just use it? If you're looking to gain formal certifications in
networking there's a good chance it'll be a Cisco certification; so the ability to take what you've
learned and just use it straight on an FS switch? That's a lot easier to sell than trying to get you
to learn a whole new ecosystem. If you know how to use Cisco IOS you should be in familiar territory
here. Speaking of Cisco, let's talk numbers. The FS model I have here retails for £320 GBP
or $369 USD (although the world being what it is right now those numbers will move around a bit).
If you consider that something like a Cisco Catalyst with these features is going to be
into four figures, that's pretty reasonable for the features you're getting; and definitely more
palatable for those without enterprise budgets such as HomeLabbers. This is their latest edition,
though; if you drop back to the older 3900 series instead of the 3910 you can actually get 10 Gbps
SPF+ ports and a lot of the same features for £285 GBP, $329 USD. They've built the 3910
to a higher specification so it does have a bit more of a premium for the additional reliability:
quadruple the meantime between failures, and a five-year warranty instead of four. All useful for
a critical service where you can't afford downtime, but you could skip that at home. Or there's a 3700
that's cheaper still at £181 GBP, $209 USD. Or you can sacrifice some connectivity and get an 8 port
plus 2 SPF model for £60 GBP, $39 USD. These are all still managed switches, by the way. You still have
scripting, syslog, SNMP, VLANs and the like; but the little eight port fella isn't gonna have all the
features of this bigger one. If I needed 10 Gbps, personally; I'd probably drop back to the 3900
and grab a couple of SPF+ modules to whack in it. As it turns out, my network traffic tops out
at around 650 Mbps so it fits well within the gigabit port speed on this switch. I've
been running my network off it for about a month and collecting these stats using SNMP. If you're
interested in how I'm collecting and processing this monitoring data then let me know in the comments.
I'm using a tool called Checkmk and it's probably worth its own video, so shout if you want to see a
review of it. While you're down there keep an eye out for the like button (it likes to be pressed)
and check the video description for links to this switch and FS.com's online store. Thanks
again to FS for sending this over. Thanks to you for watching. Thanks in advance for checking out
one of these videos as well. This is my original HomeLab video, and this? Well... it's a surprise.