Hi Alessio,
Thanks alot for taking the time and effort to reply and help me out, very much appreciated!
Bear with me, I will attempt to explain how our network structure looks today and what I'm after.
Current setup
Public IP A
Switch(2)* --- Router(2) (Ours, Simple soho router) --- Tenants network
|
| Public IP B
ISP --- Switch(1) --- Router(1) (Ours, Cisco SA 540) --- Our private network
* With really bad and unreliable rate limiting, old HP ProCurve Switch
Thats about what we have today. The reason we have two switches after each other like that, is because there is only one cable going through the floors, so we need a switch/router which is capable of handling bandwidth limiting inbound & outbound traffic at that floor.
This is what I had in mind - feel free to come with suggestions
Public IP C
Rate limited in switch to 25/25 Mbit
Router(3)*** (Tenants, we have no control) --- Specific tenant net
|
| Public IP A
| Rate limited 10/10 Mbit in switch
Switch(2)** --- Router(2) (Ours, SoHo router) --- Tenants network
|
| Public IP B
ISP --- Switch(1) --- Router(1) (Ours, Cisco SA 540) --- Our private network
** A new one (as mentioned above I was thinking of a Catalyst 3560) with fairly reliable inbound & outbound rate limiting, tossing the HP ProCurve out
*** This tenant require a "dedicated" connection (rate limited both ways) with a public IP of their own, wanting to VPN to this network from home, reaching their servers etc. They have their own router and I figured the simplest for us was to expose them their router directly to the internet, letting them configure their own firewall/port forwarding. Avoding putting them behind a second firewall, which in turn need to forward the right stuff to their router.
That is what I had in mind. Perhaps I should be buying a proper router instead, replacing Router(2), and Switch(2) with it.
Rate limiting per-port, one with 25/25, and one with 10/10. Perhaps its possible to DMZ the port/connection to the Router(3)? Would this allow their router (Router(3)) to get its own public IP? Would the DMZ be reliable enough to not interfere with their VPN and other types of connections they set up in their router?
If I would not use the Catalyst 3560 Switch (perhaps 2960 would suffice?), what did you have in mind? When you say router, do you mean a router such as the Cisco 881 Integrated services router? Or a firewall such as Cisco SA520? Or maybe the more advanced (I think) Cisco ASA5505?
I dont really know what feature is required for the inbound & outbound per-port bandwidth limiting, so I dont know what to look for in the feature set.
I'm out in deep waters here, so any help greatly appreciated, and I apologize for my lack of knowledge.
Thanks alot in advance,
Xii
---
Edit: Changed to mono type font for network map
