> Message: 4 > Date: Mon, 5 Apr 2004 18:08:49 +0200 > From: Sten Daniel S?rsdal<[email protected]> > Subject: RE: Controlling access at the Ethernet level > To: "Adrian Penisoara" <[email protected]>, > Cc: [email protected] > > > > What would you recommand ? Are there any other elegant solutions ? > > > How about using 802.1Q vlan's and dedicate a vlan to each port. > If more than 4000 users then add more gateways. > > Just be sure to go for switches that allow you to deny incoming > already tagged packets on the user side as some switches passes > already tagged packets. While this sounds theoretically like a good solution, in my experience many midrange switches (e.g. HP Procurve 25xx and 40xx- series) do not handle large numbers of VLANs well; they seem to consume RAM and CPU roughly proportional to number of active VLANs, and past some threshold you see packet loss. As one of the constraints mentioned was "can't pay to add managed switches" I would be cautious about this solution unless you *know* that all the switches handle large numbers of VLANs well, or you'll be trying to troubleshoot a network with unexplained and intermittent packet loss. Just a warning from experience, FWIW. -- Clifton -- Clifton Royston -- [email protected] Tiki Technologies Lead Programmer/Software Architect Did you ever fly a kite in bed? Did you ever walk with ten cats on your head? Did you ever milk this kind of cow? Well we can do it. We know how. If you never did, you should. These things are fun, and fun is good. -- Dr. Seuss _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"