{"id":52795,"date":"2019-11-17T00:00:00","date_gmt":"2019-11-16T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme"},"modified":"2020-02-18T14:00:35","modified_gmt":"2020-02-18T11:00:35","slug":"3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme","title":{"rendered":"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/6e7d22b08dcfd1f7fe5eb592f271c1bc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDobr\u00fd den, p\u0159\u00e1tel\u00e9! Dnes budu pokra\u010dovat v cyklu v\u011bnovan\u00e9m <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/extreme\">p\u0159ep\u00edna\u010d\u016fm Extreme<\/a><\/noindex> \u010dl\u00e1nkem o n\u00e1vrhu podnikov\u00e9 s\u00edt\u011b.<\/p>\n<p>Ve \u010dl\u00e1nku se pokus\u00edm co nejstru\u010dn\u011bji:<\/p>\n<ul>\n<li>popisovat modul\u00e1rn\u00ed p\u0159\u00edstup k n\u00e1vrhu podnikov\u00e9 s\u00edt\u011b <\/li>\n<li>prozkoumat zp\u016fsoby v\u00fdstavby jednoho z nejd\u016fle\u017eit\u011bj\u0161\u00edch modul\u016f podnikov\u00e9 s\u00edt\u011b \u2014 p\u00e1te\u0159n\u00ed s\u00edt\u011b (ip-campus)<\/li>\n<li>napsat o v\u00fdhod\u00e1ch a nev\u00fdhod\u00e1ch variant z\u00e1lohov\u00e1n\u00ed kritick\u00fdch uzl\u016f s\u00edt\u011b <\/li>\n<li>na abstraktn\u00edm p\u0159\u00edkladu navrhnout\/aktualizovat malou podnikovou s\u00ed\u0165<\/li>\n<li>vybrat p\u0159ep\u00edna\u010de Extreme pro realizaci navr\u017een\u00e9 s\u00edt\u011b<\/li>\n<li>pracovat s vl\u00e1kny a IP adresov\u00e1n\u00edm<\/li>\n<\/ul>\n<p>\nTento \u010dl\u00e1nek bude zaj\u00edmav\u00fd p\u0159edev\u0161\u00edm pro s\u00ed\u0165ov\u00e9 in\u017een\u00fdry a spr\u00e1vce podnikov\u00fdch s\u00edt\u00ed, kte\u0159\u00ed teprve za\u010d\u00ednaj\u00ed svou kari\u00e9ru \"s\u00ed\u0165ov\u00e9ho in\u017een\u00fdra\", sp\u00ed\u0161e ne\u017e pro zku\u0161en\u00e9 in\u017een\u00fdry, kte\u0159\u00ed str\u00e1vili mnoho let u oper\u00e1tor\u016f nebo ve velk\u00fdch korporac\u00edch s geograficky rozpt\u00fdlen\u00fdmi s\u00edt\u011bmi.<\/p>\n<p>Ka\u017edop\u00e1dn\u011b v\u0161echny z\u00e1jemce \u017e\u00e1d\u00e1m o pokra\u010dov\u00e1n\u00ed. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Modul\u00e1rn\u00ed p\u0159\u00edstup k n\u00e1vrhu s\u00edt\u011b<\/h2>\n<p>\nSvou \u010dl\u00e1nek za\u010dnu pom\u011brn\u011b popul\u00e1rn\u00edm modul\u00e1rn\u00edm p\u0159\u00edstupem p\u0159i n\u00e1vrhu s\u00edt\u011b, kter\u00fd umo\u017e\u0148uje slo\u017eit skl\u00e1da\u010dku z \u010d\u00e1st\u00ed s\u00edt\u011b do jedn\u00e9 celistv\u00e9 obrazce.<\/p>\n<p>Nejprve trochu abstrakce \u2014 \u010dasto tento p\u0159\u00edstup p\u0159edstavuji jako zoom na geografick\u00fdch map\u00e1ch, kdy v prvn\u00edm p\u0159ibl\u00ed\u017een\u00ed je vid\u011bt zem\u011b, ve druh\u00e9m regionech, ve t\u0159et\u00edm m\u011bstech atd.<\/p>\n<p>Jako p\u0159\u00edklad zva\u017eme tento p\u0159\u00edklad:<\/p>\n<ul>\n<li>1. p\u0159ibl\u00ed\u017een\u00ed \u2014 cel\u00e1 podnikov\u00e1 s\u00ed\u0165 p\u0159edstavuje soubor r\u016fzn\u00fdch \u00farovn\u00ed:\n<ul>\n<li>p\u00e1te\u0159n\u00ed s\u00ed\u0165 nebo campus<\/li>\n<li>hrani\u010dn\u00ed \u00farove\u0148<\/li>\n<li>\u00farove\u0148 oper\u00e1tor\u016f<\/li>\n<li>vzd\u00e1len\u00e9 z\u00f3ny<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>2. p\u0159ibl\u00ed\u017een\u00ed \u2014 ka\u017ed\u00e1 z t\u011bchto \u00farovn\u00ed je podrobn\u011b rozpracov\u00e1na na jednotliv\u00e9 moduly\n<ul>\n<li>p\u00e1te\u0159n\u00ed s\u00ed\u0165 nebo campus se skl\u00e1d\u00e1 z:\n<ul>\n<li>3- nebo 2-\u00farov\u0148ov\u00e9ho modulu, kter\u00fd popisuje podnikovou s\u00ed\u0165 a jej\u00ed \u00farovn\u011b \u2014 p\u0159\u00edstup, distribuci a\/nebo j\u00e1dro<\/li>\n<li>modulu popisuj\u00edc\u00edho datov\u00e9 centrum \u2014 st\u0159edisko zpracov\u00e1n\u00ed dat (v podstat\u011b serverov\u00e1 \u010d\u00e1st infrastruktury)<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>hrani\u010dn\u00ed \u00farove\u0148 se naopak skl\u00e1d\u00e1 z:\n<ul>\n<li>modulu p\u0159ipojen\u00ed k internetu<\/li>\n<li>modulu WAN a MAN, kter\u00fd zaji\u0161\u0165uje p\u0159ipojen\u00ed geograficky rozpt\u00fdlen\u00fdch objekt\u016f podniku<\/li>\n<li>modulu pro budov\u00e1n\u00ed VPN tunel\u016f a Remote-Access p\u0159\u00edstupu<\/li>\n<li>mnoho mal\u00fdch podnik\u016f \u010dasto m\u00e1 n\u011bkolik z t\u011bchto modul\u016f nebo dokonce v\u0161echny z nich, kter\u00e9 jsou slou\u010deny do jednoho<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>\u00farove\u0148 poskytovatel\u016f:\n<ul>\n<li>tato \u00farove\u0148 zahrnuje spojen\u00ed \u201ese sv\u011btem\u201c \u2013 temn\u00e9 optick\u00e9 vl\u00e1kna (pron\u00e1jem vl\u00e1ken od oper\u00e1tor\u016f), komunika\u010dn\u00ed kan\u00e1ly (Ethernet, G.703 atd.), p\u0159\u00edstup k internetu.<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>vzd\u00e1len\u00e1 \u00farove\u0148:\n<ul>\n<li>v\u011bt\u0161inou se jedn\u00e1 o pobo\u010dky spole\u010dnosti, kter\u00e9 jsou rozprost\u0159eny v r\u00e1mci m\u011bsta, regionu, zem\u011b nebo dokonce kontinent\u016f.<\/li>\n<li>do t\u00e9to oblasti m\u016f\u017ee tak\u00e9 pat\u0159it z\u00e1lo\u017en\u00ed datov\u00e9 centrum, kter\u00e9 duplikuje pr\u00e1ci hlavn\u00edho.<\/li>\n<li>a samoz\u0159ejm\u011b st\u00e1le popul\u00e1rn\u011bj\u0161\u00ed \u2013 teleworkers (vzd\u00e1len\u00e1 pracovn\u00ed m\u00edsta).<\/li>\n<\/ul>\n<p>\n <\/li>\n<\/ul>\n<p>\n <\/li>\n<li>3. p\u0159ibl\u00ed\u017een\u00ed \u2013 ka\u017ed\u00fd z modul\u016f se d\u011bl\u00ed na men\u0161\u00ed moduly nebo \u00farovn\u011b. Nap\u0159\u00edklad v campus s\u00edti:\n<ul>\n<li>3-\u00farov\u0148ov\u00e1 s\u00ed\u0165 se d\u011bl\u00ed na:\n<ul>\n<li>p\u0159\u00edstupovou \u00farove\u0148<\/li>\n<li>distribu\u010dn\u00ed \u00farove\u0148<\/li>\n<li>j\u00e1drovou \u00farove\u0148<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>datov\u00e9 centrum se v slo\u017eit\u011bj\u0161\u00edch p\u0159\u00edpadech m\u016f\u017ee d\u011blit na:\n<ul>\n<li>2- nebo 3-\u00farov\u0148ovou s\u00ed\u0165ovou \u010d\u00e1st<\/li>\n<li>serverovou \u010d\u00e1st<\/li>\n<\/ul>\n<p>\n <\/li>\n<\/ul>\n<p>\nV\u0161e v\u00fd\u0161e uveden\u00e9 se pokus\u00edm zobrazit v n\u00e1sleduj\u00edc\u00edm zjednodu\u0161en\u00e9m obr\u00e1zku:<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/94cd494f2b2bb2c61aa1e6b4c150c09c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak je vid\u011bt z obr\u00e1zku v\u00fd\u0161e \u2013 modul\u00e1rn\u00ed p\u0159\u00edstup pom\u00e1h\u00e1 podrobn\u011b analyzovat a strukturovat celkov\u00fd obraz na jednotliv\u00e9 prvky, se kter\u00fdmi lze n\u00e1sledn\u011b pracovat.<\/p>\n<p>V r\u00e1mci tohoto \u010dl\u00e1nku se zastav\u00edm u \u00farovn\u011b Campus Enterprise a podrobn\u011bji ji pop\u00ed\u0161u.<\/p>\n<h2>Typy IP-CAMPUS s\u00edt\u00ed<\/h2>\n<p>\nB\u011bhem m\u00e9 pr\u00e1ce u poskytovatele a zejm\u00e9na pozd\u011bji \u2013 v pr\u00e1ci integr\u00e1tora, jsem se setkal s r\u016fznou \u201ezralost\u00ed\u201c s\u00edt\u00ed klient\u016f. Ne n\u00e1hodou pou\u017e\u00edv\u00e1m term\u00edn zralost, proto\u017ee se \u010dasto setk\u00e1v\u00e1m s p\u0159\u00edpady, kdy struktura s\u00edt\u011b roste s r\u016fstem samotn\u00e9 spole\u010dnosti, a to je v z\u00e1sad\u011b z\u00e1konit\u00e9.<\/p>\n<p>V mal\u00e9 spole\u010dnosti, nach\u00e1zej\u00edc\u00ed se uvnit\u0159 jedn\u00e9 budovy, m\u016f\u017ee podnikov\u00e1 s\u00ed\u0165 sest\u00e1vat pouze z 1 okrajov\u00e9ho sm\u011brova\u010de, kter\u00fd pln\u00ed roli firewallu, n\u011bkolika p\u0159\u00edstupov\u00fdch switch\u016f a dvou nebo t\u0159\u00ed server\u016f.<\/p>\n<p>Naz\u00fdv\u00e1m takovou s\u00ed\u0165 \u201ejedno\u00farov\u0148ovou\u201c s\u00edt\u00ed \u2013 v n\u00ed zcela chyb\u00ed jasn\u00e1 j\u00e1drov\u00e1 \u00farove\u0148 s\u00edt\u011b, distribu\u010dn\u00ed \u00farove\u0148 je posunuta na okrajov\u00fd sm\u011brova\u010d (s funkcemi firewallu, VPN a mo\u017en\u00e1 proxy) a p\u0159\u00edstupov\u00e9 switche obsluhuj\u00ed jak po\u010d\u00edta\u010de zam\u011bstnanc\u016f, tak servery.<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/fe05e9fc0e26ffb37a8a291aa9c721c5.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV p\u0159\u00edpad\u011b r\u016fstu podniku \u2013 zvy\u0161ov\u00e1n\u00ed po\u010dtu zam\u011bstnanc\u016f, slu\u017eeb a server\u016f, \u010dasto je nutn\u00e9:<\/p>\n<ul>\n<li>zvy\u0161ovat po\u010det switch\u016f v s\u00edti a p\u0159\u00edstupov\u00fdch port\u016f,<\/li>\n<li>zvy\u0161ovat serverov\u00e9 kapacity.<\/li>\n<li>bojovat proti broadcastov\u00fdm dom\u00e9n\u00e1m \u2014 implementovat segmentaci s\u00edt\u011b a routov\u00e1n\u00ed mezi segmenty<\/li>\n<li>bojovat se selh\u00e1n\u00edmi v s\u00edti, kter\u00e1 zp\u016fsobuj\u00ed prostoje zam\u011bstnanc\u016f, proto\u017ee to p\u0159in\u00e1\u0161\u00ed dodate\u010dn\u00e9 finan\u010dn\u00ed n\u00e1klady pro veden\u00ed (zam\u011bstnanec je ne\u010dinn\u00fd, mzda se vypl\u00e1c\u00ed, ale pr\u00e1ce se nevykon\u00e1v\u00e1)<\/li>\n<li>b\u011bhem boje se selh\u00e1n\u00edmi p\u0159em\u00fd\u0161let o z\u00e1lohov\u00e1n\u00ed kritick\u00fdch uzl\u016f s\u00edt\u011b \u2014 router\u016f, switch\u016f, server\u016f a slu\u017eeb<\/li>\n<li>zp\u0159\u00edsnit bezpe\u010dnostn\u00ed politiku, proto\u017ee mohou vzniknout obchodn\u00ed rizika a op\u011bt pro stabiln\u011bj\u0161\u00ed pr\u00e1ci s\u00edt\u011b<\/li>\n<\/ul>\n<p>\nTo v\u0161e vede k tomu, \u017ee in\u017een\u00fdr (spr\u00e1vce s\u00edt\u011b) se d\u0159\u00edve \u010di pozd\u011bji zam\u00fd\u0161l\u00ed nad spr\u00e1vnou konstrukc\u00ed s\u00edt\u011b a p\u0159ich\u00e1z\u00ed ji\u017e k dvouvrstv\u00e9mu modelu.<\/p>\n<p>Tento model ji\u017e jasn\u011b vymezuje 2 \u00farovn\u011b \u2014 \u00farove\u0148 p\u0159\u00edstupu a \u00farove\u0148 distribuce, kter\u00e1 je z\u00e1rove\u0148 \u00farovn\u00ed j\u00e1dra (collapsed-core).<\/p>\n<p>Kombinovan\u00e1 \u00farove\u0148 distribuce a j\u00e1dra vykon\u00e1v\u00e1 n\u00e1sleduj\u00edc\u00ed funkce:<\/p>\n<ul>\n<li>agreguje linky od p\u0159\u00edstupov\u00fdch switch\u016f <\/li>\n<li>zav\u00e1d\u00ed routov\u00e1n\u00ed segment\u016f s\u00edt\u011b \u2014 u\u017eivatel\u016f a za\u0159\u00edzen\u00ed se st\u00e1v\u00e1 tolik, \u017ee se do jedn\u00e9 s\u00edt\u011b \/24 nevejdou, a pokud se vejdou, tak broadcastov\u00e9 bou\u0159ky neust\u00e1le vyvol\u00e1vaj\u00ed selh\u00e1n\u00ed (zejm\u00e9na kdy\u017e u\u017eivatel\u00e9 pom\u00e1haj\u00ed vytv\u00e1\u0159en\u00edm smy\u010dek)<\/li>\n<li>zaji\u0161\u0165uje spojen\u00ed mezi sousedn\u00edmi segmenty switch\u016f (p\u0159es rychlej\u0161\u00ed linky)<\/li>\n<li>zaji\u0161\u0165uje spojen\u00ed mezi u\u017eivateli a jejich za\u0159\u00edzen\u00edmi a serverov\u00fdm farmou, kter\u00e1 se tak\u00e9 v tomto \u010dase za\u010d\u00edn\u00e1 vy\u010dle\u0148ovat do samostatn\u00e9ho segmentu s\u00edt\u011b \u2014 datov\u00e9ho centra.<\/li>\n<li>za\u010d\u00edn\u00e1 zaji\u0161\u0165ovat spolu s p\u0159\u00edstupov\u00fdmi switchemi, v r\u016fzn\u00fdch m\u011b\u0159\u00edtk\u00e1ch, bezpe\u010dnostn\u00ed politiku, kter\u00e1 se v t\u00e9 dob\u011b za\u010d\u00edn\u00e1 objevovat ve firm\u011b. Spole\u010dnost roste, obchodn\u00ed rizika tak\u00e9 rostou (t\u00edm mysl\u00edm nejen ustanoven\u00ed o obchodn\u00edm tajemstv\u00ed, rozd\u011blen\u00ed p\u0159\u00edstupov\u00fdch politik atd., ale i o element\u00e1rn\u00edch prostojech s\u00edt\u011b a zam\u011bstnanc\u016f).<\/li>\n<\/ul>\n<p>\nTak\u017ee s\u00ed\u0165 se d\u0159\u00edve \u010di pozd\u011bji vyvine do dvouvrstv\u00e9ho modelu:<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/e327c876c5fe9ad45932b014957e3796.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV tomto modelu vznikaj\u00ed specifick\u00e9 po\u017eadavky jak na p\u0159\u00edstupov\u00e9 switche, kter\u00e9 agreguj\u00ed linky od u\u017eivatel\u016f a s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed (tisk\u00e1rny, p\u0159\u00edstupov\u00e9 body, VoIP za\u0159\u00edzen\u00ed, IP telefony, IP kamery atd.), tak na distribu\u010dn\u00ed a j\u00e1drov\u00e9 switche.<\/p>\n<p>P\u0159\u00edstupov\u00e9 switche by m\u011bly b\u00fdt ji\u017e v\u00edce inteligentn\u00ed a funk\u010dn\u00ed, aby splnily po\u017eadavky na v\u00fdkon, bezpe\u010dnost a flexibilitu s\u00edt\u011b, a m\u011bly by:<\/p>\n<ul>\n<li>m\u00edt r\u016fzn\u00e9 typy p\u0159\u00edstupov\u00fdch a p\u00e1te\u0159n\u00edch port\u016f \u2014 ide\u00e1ln\u011b s mo\u017enost\u00ed rezervy pro n\u00e1r\u016fst provozu i po\u010dtu port\u016f<\/li>\n<li>m\u00edt dostate\u010dnou switchingovou kapacitu a propustnost<\/li>\n<li>m\u00edt pot\u0159ebnou bezpe\u010dnostn\u00ed funk\u010dnost, kter\u00e1 by vyhov\u011bla sou\u010dasn\u00fdm bezpe\u010dnostn\u00edm politik\u00e1m (a ide\u00e1ln\u011b i dal\u0161\u00edm budouc\u00edm po\u017eadavk\u016fm)<\/li>\n<li>m\u00edt mo\u017enost nap\u00e1jen\u00ed t\u011b\u017eko p\u0159\u00edstupn\u00fdch s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed s mo\u017enost\u00ed jejich vzd\u00e1len\u00e9ho restartu (PoE, PoE+)<\/li>\n<li>m\u00edt mo\u017enost rezervovat vlastn\u00ed elektrick\u00e9 nap\u00e1jen\u00ed, aby bylo mo\u017en\u00e9 jej vyu\u017e\u00edt v t\u011bch m\u00edstech, kde je to nutn\u00e9<\/li>\n<li>m\u00edt (pokud mo\u017eno) dal\u0161\u00ed potenci\u00e1l pro r\u016fst funk\u010dnosti \u2014 \u010dast\u00fdm p\u0159\u00edkladem je, kdy\u017e se p\u0159\u00edstupov\u00fd switch \u010dasem m\u011bn\u00ed na distribu\u010dn\u00ed switch<\/li>\n<\/ul>\n<p>\nNa distribu\u010dn\u00ed switche se zase kladou p\u0159\u00edslu\u0161n\u00e9 po\u017eadavky:<\/p>\n<ul>\n<li>jak na p\u00e1te\u0159n\u00edch sestupn\u00fdch portech sm\u011brem k p\u0159\u00edstupov\u00fdm switch\u016fm, tak na peer rozhran\u00edch sousedn\u00edch distribu\u010dn\u00edch switch\u016f (a v budoucnu i na mo\u017en\u00e9 uplink rozhran\u00ed sm\u011brem k j\u00e1dru)<\/li>\n<li>v oblasti L2 a L3 funk\u010dnosti<\/li>\n<li>v oblasti bezpe\u010dnostn\u00ed funk\u010dnosti<\/li>\n<li>v oblasti zaji\u0161t\u011bn\u00ed odolnosti (rezervace, clustering a rezervace elektrick\u00e9ho nap\u00e1jen\u00ed)<\/li>\n<li>v oblasti zaji\u0161t\u011bn\u00ed flexibility p\u0159i vyva\u017eov\u00e1n\u00ed provozu<\/li>\n<li>m\u00edt (pokud mo\u017eno) dal\u0161\u00ed potenci\u00e1l pro r\u016fst funk\u010dnosti (transformace za\u0159\u00edzen\u00ed agregace v j\u00e1dro v pr\u016fb\u011bhu \u010dasu)<\/li>\n<li>v n\u011bkter\u00fdch p\u0159\u00edpadech m\u016f\u017ee b\u00fdt na distribu\u010dn\u00edch switch\u00edch vhodn\u00e9 pou\u017e\u00edt PoE, PoE+ porty.<\/li>\n<\/ul>\n<p>\nD\u00e1le \u2014 v\u00edce: pokud veden\u00ed podniku zavede politiku aktivn\u00edho r\u016fstu a rozvoje, s\u00ed\u0165 se tak\u00e9 bude i nad\u00e1le rozv\u00edjet \u2014 podnik m\u016f\u017ee za\u010d\u00edt pronaj\u00edmat sousedn\u00ed budovy, stav\u011bt sv\u00e9 vlastn\u00ed objekty nebo pohlcovat men\u0161\u00ed konkurenty, \u010d\u00edm\u017e se zv\u00fd\u0161\u00ed po\u010det pracovn\u00edch m\u00edst pro zam\u011bstnance. Sou\u010dasn\u011b doch\u00e1z\u00ed k r\u016fstu s\u00edt\u011b, kter\u00fd vy\u017eaduje:<\/p>\n<ul>\n<li>zaji\u0161t\u011bn\u00ed zam\u011bstnanc\u016fm pracovn\u00edch m\u00edst \u2014 jsou zapot\u0159eb\u00ed nov\u00e9 p\u0159\u00edstupov\u00e9 switche s p\u0159\u00edstupov\u00fdmi porty<\/li>\n<li>existence nov\u00fdch distribu\u010dn\u00edch switch\u016f pro agregaci link\u016f od p\u0159\u00edstupov\u00fdch switch\u016f<\/li>\n<li>v\u00fdstavbu nov\u00fdch a modernizaci st\u00e1vaj\u00edc\u00edch komunika\u010dn\u00edch linek <\/li>\n<\/ul>\n<p>\nJako d\u016fsledek doch\u00e1z\u00ed k n\u00e1r\u016fstu provozu z n\u00e1sleduj\u00edc\u00edch d\u016fvod\u016f:<\/p>\n<ul>\n<li>v d\u016fsledku zv\u00fd\u0161en\u00ed p\u0159\u00edstupov\u00fdch port\u016f a t\u00edm i u\u017eivatel\u016f s\u00edt\u011b<\/li>\n<li>v d\u016fsledku zv\u00fd\u0161en\u00ed provozu sousedn\u00edch subsyst\u00e9m\u016f, kter\u00e9 jako transport vol\u00ed podnikovou s\u00ed\u0165 \u2014 telefonie, bezpe\u010dnost, in\u017een\u00fdrsk\u00e9 syst\u00e9my atd.<\/li>\n<li>v d\u016fsledku zav\u00e1d\u011bn\u00ed dal\u0161\u00edch slu\u017eeb \u2014 s n\u00e1r\u016fstem person\u00e1lu vznikaj\u00ed nov\u00e1 odd\u011blen\u00ed, kter\u00e1 vy\u017eaduj\u00ed specifick\u00fd software<\/li>\n<li>zvy\u0161uj\u00ed se v\u00fdpo\u010detn\u00ed kapacity datov\u00fdch center, aby vyhovovaly po\u017eadavk\u016fm infrastruktury a aplikac\u00ed<\/li>\n<li>rostou po\u017eadavky na bezpe\u010dnost s\u00edt\u011b a informac\u00ed \u2014 zn\u00e1m\u00e1 tri\u00e1da CIA (vtip), ale pokud to mysl\u00edme v\u00e1\u017en\u011b, potom CIA \u2014 Confidentiality, Integrity and Availability:\n<ul>\n<li>v t\u00e9to souvislosti se k kritick\u00fdm \u00farovn\u00edm s\u00edt\u011b \u2014 distribuce a datov\u00fdch center objevuj\u00ed dal\u0161\u00ed po\u017eadavky na odolnost a z\u00e1lohov\u00e1n\u00ed<\/li>\n<li>op\u011bt doch\u00e1z\u00ed k n\u00e1r\u016fstu provozu v d\u016fsledku zav\u00e1d\u011bn\u00ed nov\u00fdch bezpe\u010dnostn\u00edch syst\u00e9m\u016f \u2014 nap\u0159\u00edklad RKV a dal\u0161\u00ed.<\/li>\n<\/ul>\n<p>\n <\/li>\n<\/ul>\n<p>\nD\u0159\u00edve \u010di pozd\u011bji povede n\u00e1r\u016fst provozu, slu\u017eeb a po\u010dtu u\u017eivatel\u016f k nutnosti zav\u00e9st dal\u0161\u00ed \u00farove\u0148 s\u00edt\u011b \u2014 j\u00e1dro, kter\u00e9 bude prov\u00e1d\u011bt vysokorychlostn\u00ed p\u0159ep\u00edn\u00e1n\u00ed\/routov\u00e1n\u00ed paket\u016f za pou\u017eit\u00ed vysokorychlostn\u00edch komunika\u010dn\u00edch linek.<\/p>\n<p>V tuto chv\u00edli m\u016f\u017ee podnik p\u0159ej\u00edt na t\u0159\u00ed\u00farov\u0148ov\u00fd model s\u00edt\u011b:<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/83b2672c654a223af8a34b78c3ab02d6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak je vid\u011bt na obr\u00e1zku v\u00fd\u0161e \u2014 v takov\u00e9 s\u00edti existuje \u00farove\u0148 j\u00e1dra, kter\u00e1 agreguje vysokorychlostn\u00ed linky od distribu\u010dn\u00edch switch\u016f. Tak mus\u00ed j\u00e1drov\u00e9 switche spl\u0148ovat po\u017eadavky na:<\/p>\n<ul>\n<li>propustnost rozhran\u00ed \u2014 1GE, 2.5GE, 10GE, 40GE, 100GE<\/li>\n<li>v\u00fdkonu p\u0159ep\u00edna\u010de (switching capacity a forwarding performance)<\/li>\n<li>typ\u016fm rozhran\u00ed \u2014 1000BASE-T, SFP, SFP+, QSFP, QSFP+<\/li>\n<li>po\u010det a sadu rozhran\u00ed<\/li>\n<li>mo\u017enost\u00ed redundantnosti (stackov\u00e1n\u00ed, clustering, z\u00e1lohov\u00e1n\u00ed \u0159\u00eddic\u00edch karet (plat\u00ed pro modul\u00e1rn\u00ed p\u0159ep\u00edna\u010de), z\u00e1lohov\u00e1n\u00ed elektrick\u00e9ho nap\u00e1jen\u00ed atd.)<\/li>\n<li>funkcionalit\u011b<\/li>\n<\/ul>\n<p>\nNa t\u00e9to \u00farovni s\u00edt\u011b je nezbytn\u011b nutn\u00e9 jak jej\u00ed technick\u00e9 modifikace:<\/p>\n<ul>\n<li>redundance uzl\u016f a spojen\u00ed j\u00e1dra (velmi, velmi, velmi \u017e\u00e1douc\u00ed)<\/li>\n<li>redundance uzl\u016f a spojen\u00ed na \u00farovni distribuce (v z\u00e1vislosti na kriti\u010dnosti)<\/li>\n<li>redundance spojen\u00ed mezi p\u0159\u00edstupov\u00fdmi p\u0159ep\u00edna\u010di a \u00farovn\u00ed distribuce (podle pot\u0159eby)<\/li>\n<li>implementace protokol\u016f dynamick\u00e9ho sm\u011brov\u00e1n\u00ed<\/li>\n<li>vyva\u017eov\u00e1n\u00ed provozu jak v j\u00e1dru, tak na \u00farovn\u00edch distribuce a p\u0159\u00edstupu (pokud je to nutn\u00e9)<\/li>\n<li>nasazen\u00ed dodate\u010dn\u00fdch slu\u017eeb \u2014 jak dopravn\u00edch, tak bezpe\u010dnostn\u00edch (pokud je to nutn\u00e9)<\/li>\n<\/ul>\n<p>\ntak i pr\u00e1vn\u00edch, ur\u010duj\u00edc\u00edch s\u00ed\u0165ovou bezpe\u010dnostn\u00ed politiku podniku, kter\u00e1 dopl\u0148uje celkovou bezpe\u010dnostn\u00ed politiku v oblasti:<\/p>\n<ul>\n<li>po\u017eadavk\u016f na implementaci a konfiguraci r\u016fzn\u00fdch bezpe\u010dnostn\u00edch funkc\u00ed na p\u0159\u00edstupov\u00fdch a distribu\u010dn\u00edch p\u0159ep\u00edna\u010d\u00edch<\/li>\n<li>po\u017eadavk\u016f na p\u0159\u00edstup, monitoring a spr\u00e1vu s\u00ed\u0165ov\u00e9ho za\u0159\u00edzen\u00ed (protokoly vzd\u00e1len\u00e9ho p\u0159\u00edstupu, povolen\u00e9 segmenty s\u00edt\u011b pro spr\u00e1vu, nastaven\u00ed logov\u00e1n\u00ed atd.)<\/li>\n<li>po\u017eadavk\u016f na redundantnost<\/li>\n<li>po\u017eadavk\u016f na vytvo\u0159en\u00ed minim\u00e1ln\u011b pot\u0159ebn\u00e9ho ZIP kompletu<\/li>\n<\/ul>\n<p>\nV t\u00e9to \u010d\u00e1sti jsem stru\u010dn\u011b popsal evoluci s\u00edt\u011b a podniku od n\u011bkolika p\u0159ep\u00edna\u010d\u016f a des\u00edtek zam\u011bstnanc\u016f a\u017e po n\u011bkolik des\u00edtek (mo\u017en\u00e1 stovek) p\u0159ep\u00edna\u010d\u016f a n\u011bkolika stovek (nebo tis\u00edc\u016f) zam\u011bstnanc\u016f, kte\u0159\u00ed p\u0159\u00edmo pracuj\u00ed v s\u00edti podniku (a p\u0159itom jsou zde je\u0161t\u011b v\u00fdrobn\u00ed odd\u011blen\u00ed a in\u017een\u00fdrsk\u00e9 s\u00edt\u011b).<br \/>\nJe jasn\u00e9, \u017ee v re\u00e1lu k takov\u00e9mu \u201ez\u00e1zra\u010dn\u00e9mu\u201c a rychl\u00e9mu rozvoji podniku nedoch\u00e1z\u00ed.<br \/>\nObvykle uplynou roky, ne\u017e podnik a s\u00ed\u0165 vzrostou z po\u010d\u00e1te\u010dn\u00ed \u00farovn\u011b 1 na 3, jak ji zde popisuji.<\/p>\n<p>Pro\u010d p\u00ed\u0161u v\u0161echny tyto samoz\u0159ejmosti? Proto\u017ee chci zde zm\u00ednit takov\u00fd term\u00edn jako ROI \u2014 return-on-investment (n\u00e1vratnost investic) a prozkoumat tu jeho str\u00e1nku, kter\u00e1 se p\u0159\u00edmo t\u00fdk\u00e1 v\u00fdb\u011bru s\u00ed\u0165ov\u00e9ho vybaven\u00ed.<\/p>\n<p>P\u0159i v\u00fdb\u011bru vybaven\u00ed si s\u00ed\u0165ov\u00ed in\u017een\u00fd\u0159i a jejich vedouc\u00ed \u010dasto vyb\u00edraj\u00ed za\u0159\u00edzen\u00ed na z\u00e1klad\u011b dvou faktor\u016f \u2014 aktu\u00e1ln\u00ed ceny vybaven\u00ed a minim\u00e1ln\u00edho technick\u00e9ho v\u00fdkonu, kter\u00fd je v sou\u010dasn\u00e9 dob\u011b pot\u0159ebn\u00fd k \u0159e\u0161en\u00ed konkr\u00e9tn\u00edho \u00fakolu nebo \u00fakol\u016f (o n\u00e1kupu vybaven\u00ed pro z\u00e1lohu se zm\u00edn\u00edm pozd\u011bji).<\/p>\n<p>P\u0159itom se m\u00e1lokdy zva\u017euj\u00ed mo\u017enosti dal\u0161\u00edho \u201er\u016fstu\u201c za\u0159\u00edzen\u00ed. V p\u0159\u00edpad\u011b, \u017ee se za\u0159\u00edzen\u00ed vy\u010derp\u00e1 \u010do do funk\u010dnosti nebo v\u00fdkonu, se n\u00e1sledn\u011b nakupuje siln\u011bj\u0161\u00ed a funkcionalit\u011bj\u0161\u00ed novinka, zat\u00edmco star\u00e9 se ulo\u017e\u00ed na skladi\u0161t\u011b, nebo se n\u011bkde na s\u00edti pos\u00edl\u00e1 podle principu \u201ea\u0165 to stoj\u00ed\u201c (to je mimochodem tak\u00e9 d\u016fvodem, pro\u010d vznik\u00e1 velk\u00fd \"zoo\" za\u0159\u00edzen\u00ed a n\u00e1kup spousty informa\u010dn\u00edch syst\u00e9m\u016f, kter\u00e9 s n\u00edm pracuj\u00ed).<\/p>\n<p>Tak\u017ee m\u00edsto n\u00e1kupu \u010d\u00e1sti licenc\u00ed na dodate\u010dnou funkcionalitu a v\u00fdkon, kter\u00e9 stoj\u00ed mnohem m\u00e9n\u011b ne\u017e nov\u00e9 vysoce v\u00fdkonn\u00e9 vybaven\u00ed, se nakupuje nov\u00e9 \u017eelezo a p\u0159ipl\u00e1c\u00ed se z n\u00e1sleduj\u00edc\u00edch d\u016fvod\u016f:<\/p>\n<ul>\n<li>s\u00ed\u0165 v\u011bt\u0161inou roste pomalu a roz\u0161\u00ed\u0159en\u00ed funk\u010dnosti nebo v\u00fdkonu p\u0159ep\u00edna\u010de va\u0161\u00ed s\u00edt\u011b m\u016f\u017ee je\u0161t\u011b dlouhou dobu sta\u010dit<\/li>\n<li>nikoho nep\u0159ekvap\u00ed, \u017ee vybaven\u00ed zahrani\u010dn\u00edch dodavatel\u016f je v\u00e1z\u00e1no na zahrani\u010dn\u00ed m\u011bnu (dolar nebo euro). Pokud m\u00e1m b\u00fdt up\u0159\u00edmn\u00fd \u2014 r\u016fst dolaru nebo eura (nebo pravideln\u00e1 mini-devalvace ruble, jak se to vezme) vede k tomu, \u017ee dolar p\u0159ed 10 lety a dolar nyn\u00ed jsou z pohledu ruble naprosto odli\u0161n\u00e9 v\u011bci<\/li>\n<\/ul>\n<p>\nShrnuj\u00edc\u00ed v\u00fd\u0161e uveden\u00e9, chci poznamenat, \u017ee n\u00e1kup s\u00ed\u0165ov\u00e9ho vybaven\u00ed s \u0161ir\u0161\u00ed funkcionalitou nyn\u00ed m\u016f\u017ee v\u00e9st k \u00faspo\u0159e v budoucnu. <br \/>\nZde n\u00e1klady na n\u00e1kup za\u0159\u00edzen\u00ed zva\u017euj\u00ed v kontextu investov\u00e1n\u00ed do sv\u00e9 s\u00edt\u011b a infrastruktury.<\/p>\n<p>Tak\u017ee mnoho dodavatel\u016f (nejen Extreme) se dr\u017e\u00ed principu pay-as-you-grow, zakl\u00e1daj\u00edc\u00edho do vybaven\u00ed spoustu funkcionality a mo\u017enost\u00ed zvy\u0161ov\u00e1n\u00ed v\u00fdkonu rozhran\u00ed, kter\u00e9 se n\u00e1sledn\u011b aktivuj\u00ed koupi jednotliv\u00fdch licenc\u00ed. Tak\u00e9 nab\u00edzej\u00ed modul\u00e1rn\u00ed p\u0159ep\u00edna\u010de s \u0161irok\u00fdm sortimentem rozhran\u00ed a procesorov\u00fdch karet a mo\u017enost\u00ed postupn\u00e9ho zvy\u0161ov\u00e1n\u00ed jak jejich po\u010dtu, tak v\u00fdkonu.<\/p>\n<h2>Rezervace kritick\u00fdch uzl\u016f<\/h2>\n<p>\nV t\u00e9to \u010d\u00e1sti \u010dl\u00e1nku bych cht\u011bl stru\u010dn\u011b popsat z\u00e1kladn\u00ed principy rezervace tak d\u016fle\u017eit\u00fdch uzl\u016f s\u00edt\u011b, jako jsou j\u00e1drov\u00e9 switche, datov\u00e9 centra nebo distribu\u010dn\u00ed uzly. A za\u010dal bych zhodnocen\u00edm obecn\u00fdch typ\u016f rezervace \u2014 stacking a clustering.<\/p>\n<p>Ka\u017ed\u00e1 z metod m\u00e1 sv\u00e9 v\u00fdhody a nev\u00fdhody, o kter\u00fdch bych cht\u011bl hovo\u0159it.<\/p>\n<p>N\u00ed\u017ee je uvedena obecn\u00e1 shrnuj\u00edc\u00ed tabulka pro srovn\u00e1n\u00ed dvou metod:<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/f48f7dbad5f838e90f21c8a90415f074.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<ul>\n<li><b>\u0159\u00edzen\u00ed<\/b> \u2014 jak je vid\u011bt z tabulky, v tomto ohledu m\u00e1 v\u00fdhodu stacking, proto\u017ee z hlediska \u0159\u00edzen\u00ed se stack skl\u00e1daj\u00edc\u00ed z v\u00edce switch\u016f jev\u00ed jako jeden switch s velk\u00fdm po\u010dtem port\u016f. M\u00edsto \u0159\u00edzen\u00ed nap\u0159\u00edklad osmi r\u016fzn\u00fdch switch\u016f p\u0159i clusteringu m\u016f\u017eete \u0159\u00eddit pouze jeden p\u0159i stackingu.<\/li>\n<li><b>vzd\u00e1lenost<\/b> \u2014 v sou\u010dasnosti, striktn\u011b vzato, v\u00fdhoda clusteringu nen\u00ed tak z\u0159ejm\u00e1, proto\u017ee se objevily technologie stacking switch\u016f prost\u0159ednictv\u00edm stacking port\u016f nebo port\u016f s dvoj\u00edm pou\u017eit\u00edm (nap\u0159\u00edklad SummitStack-V u Extreme, VSS \u2014 u Cisco atd.), kter\u00e9 tak\u00e9 z\u00e1vis\u00ed na typech transceiver\u016f. Tady je v\u00fdhoda d\u00e1na clusteringu z principu, \u017ee p\u0159i stackingu existuj\u00ed mo\u017enosti, kdy je nutn\u00e9 pou\u017e\u00edvat b\u011b\u017en\u00e9 stacking porty, kter\u00e9 se \u010dasto p\u0159ipojuj\u00ed speci\u00e1ln\u00edmi kabely omezen\u00e9 d\u00e9lky \u2014 0,5, 1, 1,5, 3 nebo 5 metr\u016f.<\/li>\n<li><b>aktualizace softwaru<\/b> \u2014 zde vid\u00edme, \u017ee clustering m\u00e1 v\u00fdhodu nad stackingem a to z n\u00e1sleduj\u00edc\u00edho d\u016fvodu \u2014 p\u0159i aktualizaci verze softwaru za\u0159\u00edzen\u00ed p\u0159i stackingu aktualizujete software na hlavn\u00edm switchi, kter\u00fd n\u00e1sledn\u011b p\u0159eb\u00edr\u00e1 roli distribuce nov\u00e9ho softwaru na standby-member switche stacku. Z jedn\u00e9 strany to usnad\u0148uje va\u0161i pr\u00e1ci, ale aktualizace softwaru \u010dasto vy\u017eaduje hardwarov\u00e9 restartov\u00e1n\u00ed za\u0159\u00edzen\u00ed, co\u017e vede k restartov\u00e1n\u00ed cel\u00e9ho stacku a t\u00edm i k p\u0159eru\u0161en\u00ed jeho \u010dinnosti a v\u0161ech slu\u017eeb na n\u011bm z\u00e1visl\u00fdch na dobu = dobu restartu. Obvykle je to velmi kritick\u00e9 pro j\u00e1dro a datov\u00e1 centra. P\u0159i clusteringu m\u00e1te k dispozici dv\u011b za\u0159\u00edzen\u00ed, kter\u00e1 nejsou vz\u00e1jemn\u011b z\u00e1visl\u00e1, na kter\u00fdch m\u016f\u017eete aktualizovat software postupn\u011b jedno po druh\u00e9m. P\u0159i tom je mo\u017en\u00e9 se vyhnout p\u0159eru\u0161en\u00edm slu\u017eeb.<\/li>\n<li><b>konfigurace nastaven\u00ed<\/b> \u2014 zde je v\u00fdhodou stackov\u00e1n\u00ed, proto\u017ee v p\u0159\u00edpad\u011b spr\u00e1vy je pot\u0159eba upravit nastaven\u00ed pouze pro jedno za\u0159\u00edzen\u00ed a jeho konfigura\u010dn\u00ed soubor. U clusteringu v\u0161ak bude po\u010det konfigura\u010dn\u00edch soubor\u016f odpov\u00eddat po\u010dtu uzl\u016f v clusteru.<\/li>\n<li><b>dostupnost<\/b> \u2014 zde jsou ob\u011b technologie p\u0159ibli\u017en\u011b na stejn\u00e9 \u00farovni, ale m\u00edrn\u00e9 v\u00fdhod\u011b se p\u0159ece jen t\u011b\u0161\u00ed clustering. D\u016fvodem je n\u00e1sleduj\u00edc\u00ed \u2014 pokud se pod\u00edv\u00e1me na stack z pohledu b\u011b\u017e\u00edc\u00edch proces\u016f a protokol\u016f, zjist\u00edme n\u00e1sleduj\u00edc\u00ed:\n<ul>\n<li>existuje master-switch, na kter\u00e9m b\u011b\u017e\u00ed v\u0161echny hlavn\u00ed procesy a protokoly (nap\u0159\u00edklad protokol dynamick\u00e9ho sm\u011brov\u00e1n\u00ed \u2014 OSPF)<\/li>\n<li>existuj\u00ed dal\u0161\u00ed slave-switch switche, na kter\u00fdch b\u011b\u017e\u00ed hlavn\u00ed procesy pot\u0159ebn\u00e9 pro pr\u00e1ci ve stacku a obsluhu provozu, kter\u00fd jimi proch\u00e1z\u00ed<\/li>\n<li>p\u0159i poru\u0161e master-switch switche, n\u00e1sleduj\u00edc\u00ed podle priority slave-switch switch detekuje selh\u00e1n\u00ed mastera<\/li>\n<li>iniciuje se jako master a spou\u0161t\u00ed v\u0161echny procesy, kter\u00e9 b\u011b\u017eely na masteru (v\u010detn\u011b n\u00e1mi sledovan\u00e9ho protokolu OSPF)<\/li>\n<li>po uplynut\u00ed ur\u010dit\u00e9ho \u010dasu spu\u0161t\u011bn\u00ed proces\u016f (obvykle velmi kr\u00e1tk\u00e9ho) ji\u017e za\u010d\u00edn\u00e1 fungovat samotn\u00fd protokol OSPF<\/li>\n<li>takto OSPF p\u0159i selh\u00e1n\u00ed jednoho z uzl\u016f v clusteringu zareaguje o n\u011bco rychleji ne\u017e p\u0159i stackov\u00e1n\u00ed (na dobu pot\u0159ebnou k spu\u0161t\u011bn\u00ed a inicializaci proces\u016f a protokol\u016f na slave switchi stacku). I kdy\u017e bych m\u011bl poznamenat, \u017ee modern\u00ed stackovac\u00ed protokoly a switche pracuj\u00ed velmi rychle, \u010dasto trv\u00e1 p\u0159eru\u0161en\u00ed provozu b\u011bhem p\u0159epnut\u00ed stacku m\u00e9n\u011b ne\u017e jednu sekundu, ale p\u0159esto nomin\u00e1ln\u011b clustering vyhr\u00e1v\u00e1 v tomto parametru.<\/li>\n<\/ul>\n<p>\n <\/li>\n<li><b>slo\u017eitost <\/b> \u2014 jak je vid\u011bt z tabulky, v oblasti slo\u017eitosti vyhr\u00e1v\u00e1 stackov\u00e1n\u00ed. To je p\u0159\u00edm\u00fd d\u016fsledek bod\u016f \u201espr\u00e1vy\u201c a \u201ekonfigurace nastaven\u00ed\u201c. Jedin\u00fd uzel vy\u017eaduje mnohem m\u00e9n\u011b \u010dasu na nastaven\u00ed a spr\u00e1vu. Tak\u00e9 p\u0159i clusteringu se \u010dasto mus\u00ed nastavovat dal\u0161\u00ed sm\u011brovac\u00ed protokoly nebo protokoly z\u00e1lo\u017en\u00edch bran \u2014 VRRP, HSRP a dal\u0161\u00ed.<\/li>\n<li><b>v\u00fdm\u011bna uzl\u016f<\/b> \u2014 zde je jednozna\u010dn\u00e1 v\u00fdhoda stakov\u00e1n\u00ed. Velmi \u010dasto je pro v\u00fdm\u011bnu switche ve stacku nutn\u00e9 prov\u00e9st minim\u00e1ln\u011b nezbytn\u00e1 nastaven\u00ed za\u0159\u00edzen\u00ed, nap\u0159\u00edklad:\n<ul>\n<li>aktualizovat firmware nov\u00e9ho switche na verzi firmwaru stacku (a to lze prov\u00e9st ihned po dod\u00e1n\u00ed switch\u016f do Z\u00cdP)<\/li>\n<li>nastavit n\u011bkolik z\u00e1kladn\u00edch p\u0159\u00edkaz\u016f pro stakov\u00e1n\u00ed (a u n\u011bkter\u00fdch typ\u016f switch\u016f to nemus\u00ed b\u00fdt ani vy\u017eadov\u00e1no)<\/li>\n<li>vyndat nefunk\u010dn\u00ed switch ze stacku a p\u0159ipojit nov\u00fd<\/li>\n<li>p\u0159ipojit nap\u00e1jen\u00ed a patchcordy<\/li>\n<\/ul>\n<p>\n <\/li>\n<li><b>elasticita <\/b> \u2014 pova\u017euji ji za jeden z hlavn\u00edch parametr\u016f. Celkov\u011b je elasticita komplexn\u00ed charakteristikou, kter\u00e1 ozna\u010duje vlastnost n\u011b\u010deho m\u011bnit se pod vlivem zat\u00ed\u017een\u00ed a vracet se do p\u016fvodn\u00edho stavu po jeho zmizen\u00ed. Jak divn\u00e9 to m\u016f\u017ee zn\u00edt, pro clustering bude vy\u0161\u0161\u00ed i s ohledem na sk\u00f3re 4:3 ve prosp\u011bch stakov\u00e1n\u00ed. V\u0161e je v lidsk\u00e9m faktoru. Ano, nev\u011b\u0159te tomu \u2014 pr\u00e1v\u011b v silov\u00fdch parametrech stakov\u00e1n\u00ed, jako je jednotn\u00e9 \u0159\u00edzen\u00ed, konfigurace nastaven\u00ed a zjednodu\u0161en\u00e1 slo\u017eitost, se skr\u00fdv\u00e1 slabost stakov\u00e1n\u00ed, kdy\u017e do hry vstupuje lidsk\u00fd faktor.<\/li>\n<\/ul>\n<p>\nVe sv\u00e9 pr\u00e1ci v oblasti IT jsem mnohokr\u00e1t narazil na situace (ano, co si budeme pov\u00eddat, tak\u00e9 jsem na tyto stejn\u00e9 hrboly \u010dasto narazil, zejm\u00e9na na za\u010d\u00e1tku), kdy\u017e in\u017een\u00fdr p\u0159i nastavov\u00e1n\u00ed stacku ud\u011blal chybu v zad\u00e1n\u00ed n\u011bjak\u00e9ho p\u0159\u00edkazu nebo ve zapnut\u00ed\/vypnut\u00ed ur\u010dit\u00e9 funkce na za\u0159\u00edzen\u00ed, co\u017e vedlo k selh\u00e1n\u00ed cel\u00e9ho stacku a jeho manu\u00e1ln\u00edmu restartu. Zvl\u00e1\u0161\u0165 bych cht\u011bl zm\u00ednit milovn\u00edky aplikace Putty pro Windows (ach, to kop\u00edrov\u00e1n\u00ed prav\u00fdm tla\u010d\u00edtkem my\u0161i).<\/p>\n<p>Ve skute\u010dnosti jsou ob\u011b technologie docela dobr\u00e9 (zejm\u00e9na ve srovn\u00e1n\u00ed s absenc\u00ed z\u00e1lohov\u00e1n\u00ed) a ka\u017ed\u00e1 m\u00e1 sv\u00e9 siln\u00e9 a slab\u00e9 str\u00e1nky, ale pro \u00farove\u0148 j\u00e1dra a pro vysoce zat\u00ed\u017een\u00e9 datov\u00e9 centrum bych p\u0159ece jen preferoval pou\u017e\u00edt clustering.<\/p>\n<p>A\u010dkoliv je to jen m\u016fj n\u00e1zor. Mnoho profesion\u00e1ln\u00edch in\u017een\u00fdr\u016f, kte\u0159\u00ed se ji\u017e mnoho let na profesion\u00e1ln\u00ed \u00farovni zab\u00fdvaj\u00ed podporou s\u00edt\u00ed, m\u016f\u017ee s ob\u011bma technologiemi stejn\u011b dob\u0159e pracovat \u2014 to v\u0161e z\u00e1le\u017e\u00ed na zku\u0161enostech a kvalifikaci.<\/p>\n<p>Krom\u011b technologi\u00ed stackov\u00e1n\u00ed a z\u00e1lohy uzl\u016f s\u00edt\u011b existuj\u00ed tak\u00e9 obecn\u00e9 principy z\u00e1lohov\u00e1n\u00ed \u010d\u00e1st\u00ed samotn\u00e9ho uzlu s\u00edt\u011b a spojen\u00ed mezi uzly:<\/p>\n<p>Pod z\u00e1lohou uvnit\u0159 uzlu s\u00edt\u011b rozum\u00edm:<\/p>\n<ul>\n<li>z\u00e1lohu nap\u00e1jec\u00edch blok\u016f \u2013 instalace dvou redundantn\u00edch nap\u00e1jec\u00edch blok\u016f (ide\u00e1ln\u011b p\u0159ipojen\u00fdch k nap\u00e1jen\u00ed prvn\u00ed kategorie) m\u016f\u017ee v\u00fdrazn\u011b usnadnit v\u00e1\u0161 \u017eivot.<\/li>\n<li>z\u00e1lohu \u0159\u00eddic\u00edch karet \u2013 v\u00edce se odv\u00edj\u00ed od modul\u00e1rn\u00edch p\u0159ep\u00edna\u010d\u016f, kter\u00e9 maj\u00ed mo\u017enost p\u0159ipojit n\u011bkolik redundantn\u00edch \u0159\u00eddic\u00edch karet.<\/li>\n<li>z\u00e1lohu rozhran\u00ed \u2013 to se rovn\u011b\u017e vztahuje p\u0159ev\u00e1\u017en\u011b na modul\u00e1rn\u00ed p\u0159ep\u00edna\u010de.<\/li>\n<\/ul>\n<p>\nPod z\u00e1lohov\u00e1n\u00edm spojen\u00ed\/seznam\u016f rozum\u00edm p\u0159edev\u0161\u00edm p\u0159\u00edtomnost redundantn\u00edch kabelov\u00fdch tras (nebo r\u00e1diov\u00fdch spojen\u00ed v p\u0159\u00edpad\u011b otev\u0159en\u00fdch prostor) s:<\/p>\n<ul>\n<li>rozlo\u017een\u00edm do r\u016fzn\u00fdch kabelov\u00fdch \u0161achet a kan\u00e1l\u016f uvnit\u0159 budovy<\/li>\n<li>geografick\u00fdm rozlo\u017een\u00edm na \u00fazem\u00ed na \u00farovni dvou a v\u00edce budov, m\u011bsta, oblasti nebo zem\u011b (takzvan\u00e9 objemov\u00e9 okruhy)<\/li>\n<\/ul>\n<p>\nP\u0159i budov\u00e1n\u00ed z\u00e1lo\u017en\u00edch spojen\u00ed je nutn\u00e9 dodr\u017eovat \u0159adu doporu\u010den\u00ed pro vybaven\u00ed:<\/p>\n<ul>\n<li>v p\u0159\u00edpad\u011b duplikace rozhran\u00ed modul\u00e1rn\u00edho p\u0159ep\u00edna\u010de, nebo pokud je p\u0159\u00edtomno stackov\u00e1n\u00ed, je nutn\u00e9 rozd\u011blit linky mezi jednotkami \u2013 rozhran\u00edmi v p\u0159\u00edpad\u011b modul\u00e1rn\u00edch p\u0159ep\u00edna\u010d\u016f a p\u0159ep\u00edna\u010di v p\u0159\u00edpad\u011b stacku.<\/li>\n<li>je doporu\u010deno pou\u017e\u00edvat protokoly pro agregaci spojen\u00ed (LACP, MLT, PAgP atd.) k seskupen\u00ed spojen\u00ed a vyv\u00e1\u017een\u00ed z\u00e1t\u011b\u017ee mezi nimi.<\/li>\n<li>pou\u017e\u00edvat sm\u011brova\u010de podporuj\u00edc\u00ed protokoly ECMP (Equal-Cost-Multi-Path) \u2013 kdy\u017e p\u0159i doru\u010dov\u00e1n\u00ed n\u011bkolika paket\u016f po jedn\u00e9 cest\u011b tyto pakety neproch\u00e1zej\u00ed pouze jednou nejlep\u0161\u00ed cestou (a rozhran\u00edm), ale jsou rozlo\u017eeny mezi v\u00edce nejlep\u0161\u00edmi cestami (a v\u00edce rozhran\u00edmi), kter\u00e9 jsou ur\u010deny na z\u00e1klad\u011b rovnosti metriky sm\u011brovac\u00edho protokolu, jen\u017e se pod\u00edl\u00ed na napln\u011bn\u00ed kone\u010dn\u00e9 tabulky sm\u011brov\u00e1n\u00ed.<\/li>\n<\/ul>\n<p>\nA nyn\u00ed, jak jsem sl\u00edbil, pop\u00ed\u0161u skute\u010dn\u00fd p\u0159\u00edpad z m\u00e9 praxe a princip \u00faspory p\u0159i z\u00e1lohov\u00e1n\u00ed kritick\u00fdch uzl\u016f, kter\u00fd se stal p\u0159ed n\u011bkolika lety:<\/p>\n<ul>\n<li>v jedn\u00e9 spole\u010dnosti, kterou nazvu X, byla standardn\u00ed 3-tierov\u00e1 s\u00ed\u0165ov\u00e1 model:\n<ul>\n<li>s n\u011bkolika j\u00e1dry<\/li>\n<li>n\u011bkolika des\u00edtkami agregac\u00ed<\/li>\n<li>n\u011bkolika tis\u00edci p\u0159\u00edstupov\u00fdmi switchemi<\/li>\n<li>n\u011bkolika des\u00edtkami tis\u00edc u\u017eivatel\u016f<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>s\u00ed\u0165 byla pom\u011brn\u011b slo\u017eit\u011b postavena:\n<ul>\n<li>s mno\u017estv\u00edm dynamick\u00fdch sm\u011brovac\u00edch protokol\u016f a protokol\u016f \u2014 OSPF, MP-BGP, MPLS, PIM, IGMP, IPv6 atd.<\/li>\n<li>s mno\u017estv\u00edm slu\u017eeb \u2014 p\u0159\u00edstup k internetu, L2 a L3 VPN, VoIP, IPTV, dedikovan\u00e9 linky atd.<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>ale bylo jedno slab\u00e9 m\u00edsto v s\u00edti \u2014 hrani\u010dn\u00ed router, kter\u00fd kombinoval funkce BGP hranice a terminoval n\u011bkter\u00e9 u\u017eivatelsk\u00e9 slu\u017eby<\/li>\n<li>ano, st\u00e1l jako k\u0159\u00eddlo letadla (n\u011bkolik milion\u016f rubl\u016f)<\/li>\n<li>ano, v t\u00e9 dob\u011b to bylo jedno z \u0161pi\u010dkov\u00fdch za\u0159\u00edzen\u00ed v nab\u00eddce nejzn\u00e1m\u011bj\u0161\u00edho v\u00fdrobce s\u00ed\u0165ov\u00e9ho vybaven\u00ed<\/li>\n<li>ano, m\u011bl b\u00fdt velmi spolehliv\u00fd \u2014 s vynikaj\u00edc\u00ed hodnotou MTBF<\/li>\n<li>ano, m\u011bl 4 nap\u00e1jec\u00ed bloky, uspo\u0159\u00e1dan\u00e9 podle sch\u00e9matu 2x2 a p\u0159ipojen\u00e9 k r\u016fzn\u00fdm UPS a vstup\u016fm.<\/li>\n<\/ul>\n<p>\nAle to v\u0161echno nezru\u0161ilo fakt, \u017ee byl jedin\u00fdm bodem selh\u00e1n\u00ed s\u00edt\u011b. <\/p>\n<p>A v jeden, zdaleka ne kr\u00e1sn\u00fd den pro m\u011b a m\u00e9 kolegy, tento router p\u0159estal \u017e\u00edt (n\u00e1sledn\u011b jsme zjistili, \u017ee do\u0161lo k n\u011bjak\u00e9 poru\u0161e na lince elektrick\u00e9ho nap\u00e1jen\u00ed p\u0159es UPS, kter\u00e1 vedla k v\u00fdpadku sou\u010dasn\u011b dvou nap\u00e1jec\u00edch blok\u016f, p\u0159i\u010dem\u017e jeden z blok\u016f sp\u00e1lil RP modul routeru a rozhran\u00ed kartu, kter\u00e9 byly p\u0159ipojeny k spole\u010dn\u00e9 datov\u00e9 sb\u011brnici za\u0159\u00edzen\u00ed).<\/p>\n<p>N\u00e1hradn\u00ed desky \u2014 RP a rozhran\u00ed karta nebyly k dispozici, ale byla smlouva na v\u00fdm\u011bnu za\u0159\u00edzen\u00ed nebo jeho komponent\u016f s jedn\u00edm z partner\u016f podle sch\u00e9matu NBD.<\/p>\n<p>Bohu\u017eel partne\u0159i m\u011bli v t\u00e9 dob\u011b na sklad\u011b pouze rozhran\u00ed kartu, ale deska RP dorazila a\u017e o n\u011bkolik dn\u00ed pozd\u011bji (po 3 dnech).<\/p>\n<p>V d\u016fsledku existence jedin\u00e9ho bodu selh\u00e1n\u00ed v s\u00edti (i s existenc\u00ed smlouvy o podpo\u0159e a v\u00fdm\u011bn\u011b za\u0159\u00edzen\u00ed) do\u0161lo k n\u00e1sleduj\u00edc\u00edm finan\u010dn\u00edm n\u00e1klad\u016fm:<\/p>\n<ul>\n<li>pod\u00edl slu\u017eeb spole\u010dnosti spojen\u00fdch s t\u00edmto borderem \u010dinil p\u0159ibli\u017en\u011b 60-70%<\/li>\n<li>jak bylo pozd\u011bji spo\u010d\u00edt\u00e1no, denn\u00ed zisk \u010dinil kolem 900 tis. rubl\u016f (p\u0159ibli\u017en\u011b) v t\u00e9 dob\u011b<\/li>\n<li>tak byly teoreticky b\u011bhem 3 dn\u016f prostoj\u016f ztraceny zisky v rozmez\u00ed od 1 milionu 620 tis\u00edc rubl\u016f do 1 milionu 890 tis\u00edc rubl\u016f<\/li>\n<\/ul>\n<p>\nSamoz\u0159ejm\u011b \u010dist\u00e9 ztr\u00e1ty byly men\u0161\u00ed, proto\u017ee kompenzace v\u011bt\u0161iny u\u017eivatel\u016f byly vraceny ne v hotovosti, ale ve form\u011b slu\u017eeb, ale i tak byly:<\/p>\n<ul>\n<li>\u010d\u00e1st kompenzac\u00ed firemn\u00edm u\u017eivatel\u016fm<\/li>\n<li>zv\u00fd\u0161en\u00e9 n\u00e1klady na zam\u011bstnance podniku, kte\u0159\u00ed b\u011bhem t\u011bchto 3\u20134 dn\u016f pracovali v pln\u00e9m po\u010dtu \u2014 p\u0159es\u010dasy, no\u010dn\u00ed slu\u017eby, nav\u00fd\u0161en\u00ed sm\u011bn atd.<\/li>\n<li>reputace vznikl\u00e9 ztr\u00e1ty, co\u017e tak\u00e9 nen\u00ed nepodstatn\u00e9<\/li>\n<li>a to nejd\u016fle\u017eit\u011bj\u0161\u00ed \u2014 nervy jak veden\u00ed, tak zam\u011bstnanc\u016f i klient\u016f<\/li>\n<\/ul>\n<p>\nV\u00fdsledkem byla revize politiky spole\u010dnosti:<\/p>\n<ul>\n<li>odm\u00edtli smlouvu o v\u00fdm\u011bn\u011b na z\u00e1klad\u011b podm\u00ednky NBD<\/li>\n<li>z\u016fstali u b\u011b\u017en\u00e9 servisn\u00ed smlouvy<\/li>\n<li>zakoupili duplicitn\u00ed sm\u011brova\u010d v hodnot\u011b p\u0159ibli\u017en\u011b 1 \u2013 1,3 milion\u016f rubl\u016f pro z\u00e1lohov\u00e1n\u00ed 90 % funkcionality hlavn\u00edho za\u0159\u00edzen\u00ed<\/li>\n<\/ul>\n<p>\nV budoucnu n\u00e1kup dal\u0161\u00edho vybaven\u00ed a z\u00e1lohov\u00e1n\u00ed hlavn\u00edho umo\u017enilo vyv\u00e1\u017eit z\u00e1t\u011b\u017e mezi nimi, pokud jde o extern\u00ed linky, provoz a u\u017eivatele, a zajistilo v budouc\u00edch hav\u00e1ri\u00edch rezerva pro firmu.<\/p>\n<h2>P\u0159\u00edklad n\u00e1vrhu s\u00edt\u011b Enterprise<\/h2>\n<p>\nV t\u00e9to \u010d\u00e1sti \u010dl\u00e1nku se pokus\u00edm shrnout hlavn\u00ed body p\u0159i n\u00e1vrhu p\u00e1te\u0159n\u00ed s\u00edt\u011b podniku. Nep\u0159epln\u00edm v\u00e1s celou metodikou PPDIOO (Prepare-Planning-Design-Implement-Operate-Optimize), ale pouze ozna\u010d\u00edm jej\u00ed hlavn\u00ed body:<\/p>\n<ul>\n<li><b>Prepare\/P\u0159\u00edprava<\/b> \u2014 je nutn\u00e9 se dohodnout se sv\u00fdm veden\u00edm na c\u00edlech modernizace s\u00edt\u011b, kter\u00fdch chcete dos\u00e1hnout \u2014 zv\u00fd\u0161it odolnost, zav\u00e9st nov\u00e9 slu\u017eby nebo technologie. Omezen\u00ed \u2014 technick\u00e1 a organiza\u010dn\u00ed zde vynech\u00e1m, proto\u017ee p\u0159edpokl\u00e1d\u00e1m, \u017ee jste zam\u011bstnancem organizace a m\u00e1te dostate\u010dn\u00fd \u010dasov\u00fd prostor na jejich p\u0159ekon\u00e1n\u00ed. K t\u00e9matu rozpo\u010dtu se vr\u00e1t\u00edm n\u00ed\u017ee.<\/li>\n<li><b>Planning\/Pl\u00e1nov\u00e1n\u00ed<\/b> \u2014 zde byste m\u011bli vytvo\u0159it \u00fapln\u00fd popis va\u0161\u00ed aktu\u00e1ln\u00ed s\u00edt\u011b (pokud ji je\u0161t\u011b nezn\u00e1te), tj. pops\u00e1n\u00ed s\u00edt\u011b tak, jak je nyn\u00ed:\n<ul>\n<li>po\u010det a typ vybaven\u00ed<\/li>\n<li>po\u010det a typy port\u016f<\/li>\n<li>existuj\u00edc\u00ed kabelov\u00e9 trasy a sch\u00e9mata p\u0159ep\u00edn\u00e1n\u00ed uvnit\u0159 budov a mezi nimi<\/li>\n<li>sch\u00e9mata nap\u00e1jen\u00ed<\/li>\n<li>L2 a L3 adresov\u00e1n\u00ed<\/li>\n<li>vykreslit mapy s\u00edt\u00ed Wi-Fi s ozna\u010den\u00edm p\u0159\u00edstupov\u00fdch bod\u016f a kontroler\u016f<\/li>\n<li>popsat sv\u016fj serverov\u00fd farmu<\/li>\n<li>je \u017e\u00e1douc\u00ed popsat v\u0161echny sv\u00e9 slu\u017eby a vazby mezi nimi<\/li>\n<li>pokud m\u00e1te ji\u017e zavedenou v n\u011bjak\u00e9 podob\u011b politiku s\u00ed\u0165ov\u00e9 bezpe\u010dnosti a rozli\u0161en\u00ed p\u0159\u00edstup\u016f, nezapome\u0148te ji zohlednit p\u0159i n\u00e1vrhu<\/li>\n<li>Hned si v\u0161imnu, \u017ee druh\u00fd krok vlastn\u011b p\u0159edstavuje kompletn\u00ed inventarizaci s\u00edt\u011b, za\u010d\u00ednaj\u00edc\u00ed od kabelov\u00e9 infrastruktury a sch\u00e9mat nap\u00e1jen\u00ed, a kon\u010d\u00edc\u00ed slu\u017ebami (aplikacemi a jejich porty). Tento krok je velmi pracn\u00fd a n\u011bkdy a\u017e \u00fanavn\u00fd. Pokud vy nebo v\u00e1\u0161 p\u0159edch\u016fdce nevedli dokumentaci nebo dokonce z\u00e1kladn\u00ed monitoring, je \u010das o tom p\u0159em\u00fd\u0161let. S\u00ed\u0165 m\u00e1 tendenci se \u010dasem m\u011bnit r\u016fznou rychlost\u00ed a pouze veden\u00ed aktu\u00e1ln\u00ed dokumentace nebo monitorovac\u00edho syst\u00e9mu v\u00e1m m\u016f\u017ee pomoci sledovat jej\u00ed stav a usnadnit jej\u00ed administraci. Ale to u\u017e pat\u0159\u00ed k kroku operate.<\/li>\n<\/ul>\n<p>\n <\/li>\n<li><b>N\u00e1vrh<\/b> \u2014 vyzbrojeni \u00fapln\u00fdmi znalostmi va\u0161\u00ed s\u00edt\u011b, z\u00edskan\u00fdmi v p\u0159edchoz\u00edm kroku, si kone\u010dn\u011b sed\u00e1te a p\u0159em\u00fd\u0161l\u00edte, jak modernizovat va\u0161i s\u00ed\u0165. N\u00ed\u017ee se pokus\u00edm demonstrovat mal\u00fd p\u0159\u00edklad v\u00fdpo\u010dtu s\u00edt\u011b.<\/li>\n<\/ul>\n<p>\nPro sebe jsem si sestavil mal\u00fd seznam se vstupn\u00edmi daty, kter\u00fdmi se budu \u0159\u00eddit p\u0159i v\u00fdpo\u010dtu a n\u00e1vrhu backbone s\u00edt\u011b.<\/p>\n<p>P\u0159edstavme si krok Prepare ve form\u011b seznamu toho, co m\u00e1me k dispozici a co pl\u00e1nujeme ud\u011blat:<\/p>\n<ul>\n<li>existuje pom\u011brn\u011b velk\u00fd podnik s p\u0159ibli\u017en\u00fdm po\u010dtem pracovn\u00edch m\u00edst, asi 700-800 kus\u016f (t\u00edm mysl\u00edm zam\u011bstnance, kte\u0159\u00ed pot\u0159ebuj\u00ed p\u0159\u00edstup do podnikov\u00e9 s\u00edt\u011b)<\/li>\n<li>existuje n\u011bkolik samostatn\u00fdch budov v r\u00e1mci are\u00e1lu podniku:<\/li>\n<li><b>Hlavn\u00ed budovy:<\/b>\n<ul>\n<li>po\u010det budov \u2014 2 kusy<\/li>\n<li>po\u010det pater v budov\u011b \u2014 7 pater<\/li>\n<li>po\u010det telekomunika\u010dn\u00edch sk\u0159\u00edn\u00ed na pat\u0159e v jedn\u00e9 budov\u011b \u2014 3 (celkem 21) kus\u016f<\/li>\n<li>po\u010det zam\u011bstnanc\u016f v budov\u011b =~ 250 osob<\/li>\n<\/ul>\n<p>\n <\/li>\n<li><b>Dal\u0161\u00ed budovy:<\/b>\n<ul>\n<li>po\u010det budov \u2014 10 kus\u016f<\/li>\n<li>po\u010det pater v budov\u011b\/d\u00edln\u011b \u2014 2 patra<\/li>\n<li>po\u010det telekomunika\u010dn\u00edch sk\u0159\u00edn\u00ed v budov\u011b \u2014 3 kusy<\/li>\n<li>po\u010det zam\u011bstnanc\u016f v budov\u011b =~ 20 osob<\/li>\n<\/ul>\n<p>\n <\/li>\n<li><b>Sou\u010dasn\u00e1 \u00farove\u0148 j\u00e1dra s\u00edt\u011b (mimochodem velmi b\u011b\u017en\u00e9 sch\u00e9ma, kter\u00e9 jsem se setkal mnohokr\u00e1t v r\u016fzn\u00fdch podob\u00e1ch a s r\u016fzn\u00fdmi porty) je p\u0159edstavena:<\/b>\n<ul>\n<li>2 p\u0159ep\u00edna\u010di L2:\n<ul>\n<li>1Gb porty typu RJ-45 \u2014 24 kus\u016f<\/li>\n<li>1Gb SFP porty \u2014 4 kusy<\/li>\n<\/ul>\n<\/li>\n<li>1 p\u0159ep\u00edna\u010dem L2:\n<ul>\n<li>1Gb SFP porty \u2014 24 kus\u016f<\/li>\n<\/ul>\n<\/li>\n<li>topologie j\u00e1dra \u2014 ring<\/li>\n<li>peer-to-peer spojen\u00ed mezi p\u0159ep\u00edna\u010di jsou realizov\u00e1na pomoc\u00ed optick\u00fdch vl\u00e1ken<\/li>\n<li>p\u0159ep\u00edna\u010de jsou um\u00edst\u011bny v mal\u00fdch serverov\u00fdch m\u00edstnostech se sk\u0159\u00edn\u011bmi<\/li>\n<\/ul>\n<\/li>\n<li><b>Sou\u010dasn\u00e1 \u00farove\u0148 distribuce:<\/b>\n<ul>\n<li>kombinov\u00e1no s \u00farovn\u00ed j\u00e1dra s\u00edt\u011b v oblasti agregace od p\u0159\u00edstupov\u00fdch switch\u016f<\/li>\n<li>Adresace L3 je um\u00edst\u011bna na hrani\u010dn\u00edm routeru a\/nebo firewallu<\/li>\n<\/ul>\n<\/li>\n<li><b>Aktu\u00e1ln\u00ed \u00farove\u0148 p\u0159\u00edstupu:<\/b>\n<ul>\n<li>L2 switche s 16 x 100 Mb RJ-45 p\u0159\u00edstupov\u00fdmi porty a 2 gigabitov\u00fdmi kombi uplink porty RJ-45\/SFP<\/li>\n<li>switche jsou um\u00edst\u011bny v rackech na patrech<\/li>\n<li>topologie p\u0159\u00edstupov\u00fdch switch\u016f:\n<ul>\n<li>hv\u011bzda (hub-and-spoke) s j\u00e1drov\u00fdm\/distribu\u010dn\u00edm switchem uprost\u0159ed<\/li>\n<li>v\u011btev\/spoke p\u0159edstavuje \u0159et\u011bzec switch\u016f na patrech \u2014 3 ks v sekvenci<\/li>\n<\/ul>\n<\/li>\n<li>existuj\u00ed ne\u0159\u00edzen\u00e9 p\u0159\u00edstupov\u00e9 switche<\/li>\n<li>switche v 9 dal\u0161\u00edch sk\u0159\u00edn\u00edch jsou p\u0159ipojeny pomoc\u00ed mediakonvertor\u016f (p\u0159evodn\u00edky optick\u00e9ho sign\u00e1lu na elektrick\u00fd)<\/li>\n<\/ul>\n<\/li>\n<li><b>Aktu\u00e1ln\u00ed kabelov\u00e1 infrastruktura:<\/b>\n<ul>\n<li>Kabelov\u00fd syst\u00e9m mezi budovami:\n<ul>\n<li>existuje optick\u00fd kabel mezi 2 hlavn\u00edmi budovami s kapacitou 8 vl\u00e1ken <\/li>\n<li>existuje po 1 optick\u00e9m kabelu mezi jedn\u00edm z vedlej\u0161\u00edch budov (kde je um\u00edst\u011bn j\u00e1drov\u00fd switch) a ka\u017edou z hlavn\u00edch budov s kapacitou 8 vl\u00e1ken ka\u017ed\u00fd<\/li>\n<li>existuje po 1 optick\u00e9m kabelu mezi vedlej\u0161\u00edmi budovami a budovami se za\u0159\u00edzen\u00fdmi j\u00e1drov\u00fdmi switchemi s kapacitou 4 vl\u00e1kna (jejich rozlo\u017een\u00ed je zn\u00e1zorn\u011bno na obr\u00e1zku n\u00ed\u017ee)<\/li>\n<li>typ vl\u00e1ken ve v\u0161ech kabelech \u2014 jednovidov\u00e9\/SMF<\/li>\n<li>pou\u017e\u00edvaj\u00ed se 2-vl\u00e1knov\u00e9 jednovidov\u00e9 SFP transceivery<\/li>\n<li>\u010d\u00e1st kabel\u016f je ukon\u010dena na optick\u00fdch rozvad\u011b\u010d\u00edch (ODF) v samostatn\u00fdch m\u00edstnostech (rozvad\u011b\u010dov\u00e9 m\u00edstnosti\/serverovny), a \u010d\u00e1st kabel\u016f v podla\u017en\u00edch rozvad\u011b\u010d\u00edch<\/li>\n<\/ul>\n<p>\n <\/li>\n<li>Kabelov\u00fd syst\u00e9m uvnit\u0159 budov:\n<ul>\n<li>existuje sm\u00ed\u0161en\u00e1 kabelov\u00e1 struktura mezi serverovnami a prvn\u00edmi sk\u0159\u00edn\u011bmi na patrech:<\/li>\n<li>m\u011bd\u011bn\u00e9 kabely Cat5e \u2014 10 ks (nebo 100 p\u00e1r\u016f kabel\u016f)<\/li>\n<li>optick\u00fd multimodov\u00fd\/MMF kabel na 4 nebo 8 vl\u00e1ken \u2014 1 ks<\/li>\n<li>optick\u00fd multimodov\u00fd\/MMF kabel na 4 vl\u00e1kna mezi patrov\u00fdmi sk\u0159\u00edn\u011bmi<\/li>\n<li>m\u011bd\u011bn\u00e9 kabely Cat5e mezi patrov\u00fdmi sk\u0159\u00edn\u011bmi a p\u0159\u00edstupov\u00fdmi z\u00e1suvkami<\/li>\n<\/ul>\n<\/li>\n<li><b>aktu\u00e1ln\u00ed datov\u00e9 centrum:<\/b>\n<ul>\n<li>existuje n\u011bkolik server\u016f, nap\u0159\u00edklad 6 ks<\/li>\n<li>p\u0159ipojeny 1Gb porty do j\u00e1drov\u00e9ho switche v 1. hlavn\u00ed budov\u011b<\/li>\n<li>v\u0161echny podnikov\u00e9 aplikace jsou um\u00edst\u011bny na serverech<\/li>\n<\/ul>\n<\/li>\n<li><b>adresace L2, L3 a sm\u011brov\u00e1n\u00ed:<\/b>\n<ul>\n<li>v s\u00edti existuje n\u011bkolik VLAN \u2014 2,3 kusy na budovu<\/li>\n<li>servery jsou vy\u010dlen\u011bny do samostatn\u00e9 \/24 s\u00edt\u011b<\/li>\n<li>pro intern\u00ed pot\u0159eby se pou\u017e\u00edvaj\u00ed \u0161ed\u00e9 s\u00edt\u011b t\u0159\u00eddy B, kter\u00e9 spadaj\u00ed do rozsahu \u2014 172.16.0.0\/16<\/li>\n<li>L3 adresy jsou terminov\u00e1ny na hrani\u010dn\u00edm routeru a\/nebo na firewallu<\/li>\n<li>pou\u017e\u00edv\u00e1 se statick\u00e1 routov\u00e1n\u00ed<\/li>\n<\/ul>\n<\/li>\n<li><b>dal\u0161\u00ed informace:<\/b>\n<ul>\n<li>telefonie:\n<ul>\n<li>v budov\u00e1ch a n\u011bkter\u00fdch objektech je nasazena tradi\u010dn\u00ed telefonie s pou\u017eit\u00edm star\u00fdch digit\u00e1ln\u00edch \u00fast\u0159edn\u00e1ch (ne IP-\u00fast\u0159edn\u00e1ch)<\/li>\n<li>je t\u0159eba z\u0159\u00eddit telefonii v nov\u00fdch objektech bez n\u00e1klad\u016f na pokl\u00e1dku drah\u00fdch m\u011bd\u011bn\u00fdch kabelov\u00fdch veden\u00ed ur\u010dit\u00e9 kapacity a v\u00fdstavbu duplicitn\u00ed strukturovan\u00e9 kabel\u00e1\u017ee pro telefonii uvnit\u0159 budov<\/li>\n<li>v pr\u016fb\u011bhu \u010dasu se pl\u00e1nuje zaveden\u00ed IP telefonie na cel\u00e9m \u00fazem\u00ed podniku, jej\u00ed spojen\u00ed s CRM syst\u00e9my a p\u0159echod na ni v\u0161ech zam\u011bstnanc\u016f<\/li>\n<\/ul>\n<\/li>\n<li><b>kapacita port\u016f:<\/b>\n<ul>\n<li>je nutn\u00e9 analyzovat aktu\u00e1ln\u00ed kapacitu p\u00e1te\u0159n\u00edch port\u016f a p\u0159\u00edstupov\u00fdch port\u016f a rezervovat alespo\u0148 25-30 % pro budouc\u00ed pot\u0159eby<\/li>\n<li>analyzovat dostate\u010dnost sou\u010dasn\u00e9 propustnosti p\u0159\u00edstupov\u00fdch port\u016f a p\u00e1te\u0159n\u00edch spoj\u016f<\/li>\n<li>p\u0159edpokl\u00e1dat p\u0159\u00edtomnost PoE\/PoE+ p\u0159\u00edstupov\u00fdch port\u016f pro za\u0159\u00edzen\u00ed z p\u0159\u00edbuzn\u00fdch syst\u00e9m\u016f \u2014 videodohled a telefonii<\/li>\n<\/ul>\n<\/li>\n<li><b>videodohled:<\/b>\n<ul>\n<li>pl\u00e1nuje se vyu\u017e\u00edt s\u00ed\u0165 podniku jako transport pro s\u00ed\u0165 videodohledu<\/li>\n<li>je nutn\u00e9 p\u0159edpokl\u00e1dat p\u0159\u00edtomnost PoE port\u016f pro kamery videodohledu<\/li>\n<\/ul>\n<\/li>\n<li><b>bezdr\u00e1tov\u00e9 syst\u00e9my:<\/b>\n<ul>\n<li>v budoucnu se pl\u00e1nuje zaveden\u00ed bezdr\u00e1tov\u00e9 infrastruktury pro mobilitu zam\u011bstnanc\u016f<\/li>\n<li>je nutn\u00e9 p\u0159edpokl\u00e1dat p\u0159\u00edtomnost PoE port\u016f pro p\u0159\u00edstupov\u00e9 body<\/li>\n<\/ul>\n<\/li>\n<li><b>rozpo\u010det, \u010dasov\u00e9 r\u00e1mce a po\u017eadavky na za\u0159\u00edzen\u00ed:<\/b>\n<ul>\n<li>co nejv\u00edce vyu\u017e\u00edt st\u00e1vaj\u00edc\u00ed za\u0159\u00edzen\u00ed <\/li>\n<li>p\u0159i n\u00e1vrhu s\u00edt\u011b vz\u00edt v \u00favahu mo\u017enost roz\u0161\u00ed\u0159en\u00ed propustnosti s\u00edt\u011b na N let dop\u0159edu<\/li>\n<li>p\u0159i n\u00e1vrhu s\u00edt\u011b vz\u00edt v \u00favahu podporu r\u016fzn\u00fdch bezpe\u010dnostn\u00edch funkc\u00ed \u2014 zde je seznam funkcionality, po\u010d\u00ednaje port-security a kon\u010de autentizac\u00ed a autorizac\u00ed u\u017eivatel\u016f podle 802.1x.<\/li>\n<li>maxim\u00e1ln\u011b rezervovat kritick\u00e9 uzly s\u00edt\u011b prim\u00e1rn\u00ed d\u016fle\u017eitosti \u2014 j\u00e1dro a datov\u00e9 centrum, a zajistit mo\u017enost rezervace uzl\u016f sekund\u00e1rn\u00ed d\u016fle\u017eitosti \u2014 uzl\u016f distribuce<\/li>\n<li>rozpo\u010det projektu by m\u011bl zahrnovat postupn\u00e9 financov\u00e1n\u00ed v n\u011bkolika f\u00e1z\u00edch<\/li>\n<li>v\u00fd\u0161e rozpo\u010dtu \u2014 zde si ka\u017ed\u00e9 podnik\u00e1n\u00ed ur\u010duje samo, vych\u00e1zej\u00edc ze sv\u00fdch finan\u010dn\u00edch ukazatel\u016f<\/li>\n<li>Term\u00edny - v ide\u00e1ln\u00edm p\u0159\u00edpad\u011b nebudou \u017e\u00e1dn\u00e9 jasn\u00e9 term\u00edny, proto\u017ee se jedn\u00e1 o vnit\u0159n\u00ed projekt spole\u010dnosti, kter\u00fd je realizov\u00e1n jej\u00edmi zam\u011bstnanci, nebo budou relativn\u011b pohodln\u00e9 - nap\u0159\u00edklad 1 rok (a v\u00edce). V hor\u0161\u00edm p\u0159\u00edpad\u011b se m\u016f\u017ee jednat o obdob\u00ed od 3 m\u011bs\u00edc\u016f do p\u016fl roku.<\/li>\n<\/ul>\n<\/li>\n<li><b>\u0159e\u0161it aktu\u00e1ln\u00ed probl\u00e9my v s\u00edti:<\/b>\n<ul>\n<li>ztr\u00e1ty paket\u016f<\/li>\n<li>probl\u00e9my s DHCP na v\u00edce \u010di m\u00e9n\u011b inteligentn\u00edch p\u0159\u00edstupov\u00fdch p\u0159ep\u00edna\u010d\u00edch, spojen\u00e9 s pou\u017e\u00edv\u00e1n\u00edm rodiny protokol\u016f STP k boji proti smy\u010dk\u00e1m na p\u0159\u00edstupov\u00fdch portech.<\/li>\n<li>zbavit se existence DHCP serveru v ka\u017ed\u00e9m VLAN zam\u011bstnanc\u016f<\/li>\n<li>vznik smy\u010dek p\u0159ep\u00edn\u00e1n\u00ed, spojen\u00fdch s neautorizovan\u00fdm p\u0159ipojen\u00edm \u0159\u00edzen\u00fdch\/ner\u00edzen\u00fdch p\u0159ep\u00edna\u010d\u016f v kancel\u00e1\u0159\u00edch a p\u0159ipojen\u00edm r\u016fzn\u00fdch za\u0159\u00edzen\u00ed<\/li>\n<li>seznam lze pokra\u010dovat st\u00e1le d\u00e1le\u2026<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\nKrok pl\u00e1nov\u00e1n\u00ed - charakteristika stavu va\u0161\u00ed aktu\u00e1ln\u00ed s\u00edt\u011b, jak ji\u017e bylo zm\u00edn\u011bno, z\u00e1vis\u00ed na kvalitn\u00edm syst\u00e9mu monitorov\u00e1n\u00ed a \u00farovni jeho dokumentace. V t\u00e9to f\u00e1zi budete muset:<\/p>\n<ul>\n<li>minim\u00e1ln\u011b nakreslit st\u00e1vaj\u00edc\u00ed s\u00ed\u0165 pro dal\u0161\u00ed anal\u00fdzu<\/li>\n<li>shrom\u00e1\u017edit data z vybaven\u00ed:\n<ul>\n<li>dopravn\u00ed z\u00e1t\u011b\u017e na p\u00e1te\u0159n\u00edch portech<\/li>\n<li>chyby na portech<\/li>\n<li>zat\u00ed\u017een\u00ed CPU a spot\u0159eba pam\u011bti na p\u0159ep\u00edna\u010d\u00edch a sm\u011brova\u010d\u00edch<\/li>\n<li>vytvo\u0159it L2-L3 sch\u00e9mata podle VLAN a IP adres<\/li>\n<\/ul>\n<\/li>\n<li>zvednout sch\u00e9mata kabel\u00e1\u017ee:\n<ul>\n<li>vl\u00e1knov\u00e9 sch\u00e9mata a sch\u00e9mata p\u00e1jen\u00ed optick\u00fdch rozvad\u011b\u010d\u016f<\/li>\n<li>sch\u00e9mata m\u011bd\u011bn\u00e9ho kabelov\u00e9ho rozvodu mezi servery a patry<\/li>\n<li>sch\u00e9mata m\u011bd\u011bn\u00e9ho kabelov\u00e9ho rozvodu mezi patry a kancel\u00e1\u0159emi<\/li>\n<li>zkontrolovat p\u0159\u00edtomnost optick\u00fdch rozvad\u011b\u010d\u016f a patch panel\u016f v serverovn\u00e1ch a sk\u0159\u00edn\u00edch<\/li>\n<\/ul>\n<\/li>\n<li>zkontrolovat sch\u00e9mata nap\u00e1jen\u00ed v serverovn\u00e1ch a patrov\u00fdch sk\u0159\u00edn\u00edch<\/li>\n<li>zkontrolovat p\u0159\u00edtomnost UPS a bateri\u00ed na kritick\u00fdch uzlech<\/li>\n<li>analyzovat v\u0161echna data<\/li>\n<\/ul>\n<p>\nNa z\u00e1klad\u011b dat z p\u0159\u00edpravy jsem vytvo\u0159il p\u0159ibli\u017en\u00e9 logick\u00e9 sch\u00e9ma:<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/0941c3762961d5b6502ac57971cc13a3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le, v souladu s modul\u00e1rn\u00edm p\u0159\u00edstupem, je nutn\u00e9 vy\u010dlenit \u00farovn\u011b a moduly podniku:<\/p>\n<p><img decoding=\"async\" alt=\"3. N\u00e1vrh podnikov\u00e9 s\u00edt\u011b na p\u0159ep\u00edna\u010d\u00edch Extreme\" src=\"\/wp-content\/uploads\/2019\/11\/f4e060586cb039ea318ba83c61ed876e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHrani\u010dn\u00ed (Edge) se v tomto \u010dl\u00e1nku nebudu v\u011bnovat, ale kr\u00e1tce p\u0159ipomenu z\u00e1kladn\u00ed teze ka\u017ed\u00e9ho z modul\u016f Campusu:<\/p>\n<ul>\n<li><b>P\u0159\u00edstup - na t\u00e9to \u00farovni by m\u011bl zaji\u0161\u0165ovat:<\/b>\n<ul>\n<li>pot\u0159ebn\u00fd po\u010det port\u016f pro p\u0159\u00edstup u\u017eivatel\u016f do s\u00edt\u011b<\/li>\n<li>dodr\u017eov\u00e1n\u00ed bezpe\u010dnostn\u00edch politik - filtrov\u00e1n\u00ed provozu a protokol\u016f<\/li>\n<li>kompresi broadcast dom\u00e9n a segmentaci s\u00edt\u011b pomoc\u00ed VLAN<\/li>\n<li>nasazen\u00ed jednotliv\u00fdch VLAN pro hlasov\u00fd provoz<\/li>\n<li>podpora QoS<\/li>\n<li>podpora PoE p\u0159\u00edstupov\u00fdch port\u016f<\/li>\n<li>podpora IP multicastu<\/li>\n<li>odolnost vzestupn\u00fdch komunika\u010dn\u00edch odkaz\u016f spolu s distribu\u010dn\u00ed \u00farovn\u00ed (preferov\u00e1no)<\/li>\n<\/ul>\n<\/li>\n<li><b>Distribuce \u2014 na t\u00e9to \u00farovni by m\u011blo b\u00fdt zaji\u0161t\u011bno:<\/b>\n<ul>\n<li>po\u017eadovan\u00fd po\u010det port\u016f pro p\u0159ipojen\u00ed p\u0159\u00edstupov\u00fdch switch\u016f<\/li>\n<li>agregace a z\u00e1lohov\u00e1n\u00ed odkaz\u016f p\u0159\u00edstupov\u00fdch switch\u016f<\/li>\n<li>IP sm\u011brov\u00e1n\u00ed<\/li>\n<li>filtrace paket\u016f<\/li>\n<li>podpora QoS<\/li>\n<li>odolnost na \u00farovni odkaz\u016f, vybaven\u00ed a nap\u00e1jen\u00ed (velmi \u017e\u00e1douc\u00ed)<\/li>\n<\/ul>\n<\/li>\n<li><b>J\u00e1dro \u2014 m\u011blo by zaji\u0161\u0165ovat:<\/b>\n<ul>\n<li>vysokou rychlost p\u0159ep\u00edn\u00e1n\u00ed a routov\u00e1n\u00ed paket\u016f<\/li>\n<li>po\u017eadovan\u00fd po\u010det port\u016f pro p\u0159ipojen\u00ed distribu\u010dn\u00edch switch\u016f<\/li>\n<li>podporu IP routov\u00e1n\u00ed a dynamick\u00fdch routovac\u00edch protokol\u016f s rychlou konvergenc\u00ed s\u00edt\u011b <\/li>\n<li>podpora QoS<\/li>\n<li>funkcionalitu zabezpe\u010den\u00ed pro ochranu p\u0159\u00edstupu k za\u0159\u00edzen\u00ed a \u0159\u00edd\u00edc\u00edmu pl\u00e1nu<\/li>\n<li>odolnost na \u00farovni vybaven\u00ed a nap\u00e1jen\u00ed (povinn\u011b)<\/li>\n<\/ul>\n<\/li>\n<li><b>Datov\u00e9 centrum \u2014 s\u00ed\u0165ov\u00e1 \u00farove\u0148 tohoto modulu by m\u011bla zaji\u0161\u0165ovat:<\/b>\n<ul>\n<li>vysokorychlostn\u00ed komunika\u010dn\u00ed linky<\/li>\n<li>po\u017eadovan\u00fd po\u010det port\u016f pro p\u0159ipojen\u00ed server\u016f<\/li>\n<li>z\u00e1lohov\u00e1n\u00ed komunika\u010dn\u00edch odkaz\u016f jak mezi servery a switchemi datov\u00e9ho centra, tak mezi switchemi datov\u00e9ho centra a j\u00e1drem s\u00edt\u011b (povinn\u011b)<\/li>\n<li>z\u00e1lohov\u00e1n\u00ed vybaven\u00ed a nap\u00e1jen\u00ed (povinn\u011b)<\/li>\n<li>podpora QoS<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\nD\u00e1le je pot\u0159eba spo\u010d\u00edtat na\u0161e porty a komunika\u010dn\u00ed odkazy a stanovit po\u017eadavky.<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/nb\/mv\/33\/nbmv335-gib7s0tsfzcguvznpim.png\">\u00darove\u0148 p\u0159\u00edstupu \u2014 tabulka v\u00fdpo\u010dtu port\u016f<\/a><\/noindex><\/p>\n<p>Tak jsme z\u00edskali data o rozlo\u017een\u00ed p\u0159\u00edstupov\u00fdch port\u016f podle budov. Nyn\u00ed je t\u0159eba analyzovat po\u017eadavky na \u00farove\u0148 p\u0159\u00edstupu a pozn\u00e1mky a navrhnout mo\u017enosti \u0159e\u0161en\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/b7\/sz\/gx\/b7szgxg97yj0ddyej9lzt26fzx4.png\">\u00darove\u0148 p\u0159\u00edstupu \u2014 po\u017eadavky a mo\u017enosti \u0159e\u0161en\u00ed<\/a><\/noindex><\/p>\n<p>D\u00e1le spo\u010d\u00edt\u00e1me porty a komunika\u010dn\u00ed odkazy pro n\u00e1sleduj\u00edc\u00ed \u00farovn\u011b:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/xf\/yu\/ds\/xfyudsa-ratfg_qy7oxrhn7rj8e.png\">\u00darove\u0148 distribuce<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/op\/5u\/ot\/op5uothcj0pvbpl7ql0cfyj7fpw.png\">\u00darove\u0148 j\u00e1dra<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/jr\/ie\/oe\/jrieoeexaj8cqvzzmkg5lue386i.png\">\u00darove\u0148 datov\u00e9ho centra<\/a><\/noindex><\/p>\n<p>P\u0159i v\u00fdpo\u010dtu jsme z\u00edskali n\u00e1sleduj\u00edc\u00ed:<\/p>\n<ul>\n<li><b>p\u0159\u00edstupovou \u00farove\u0148<\/b> \u2014 pot\u0159ebujeme 24- a 48-portov\u00e9 p\u0159\u00edstupov\u00e9 switche, ide\u00e1ln\u011b s 1Gb p\u0159\u00edstupov\u00fdmi porty a optick\u00fdmi uplink porty SFP s podporou PoE a \u0161irok\u00fdm funk\u010dn\u00edm rozsahem:\n<ul>\n<li>v sou\u010dtu poskytnou 504 p\u0159\u00edstupov\u00fdch port\u016f, co\u017e v podstat\u011b pokryje po\u017eadavky na rezervn\u00ed porty, pokud bude rozhodnuto pou\u017e\u00edt 2 porty na pracovn\u00ed m\u00edsto \u2014 IP telefon a datov\u00fd port.<\/li>\n<li>mo\u017enost pou\u017eit\u00ed jednoho 48-portov\u00e9ho p\u0159ep\u00edna\u010de s PoE funkc\u00ed na ka\u017ed\u00e9m podla\u017e\u00ed, kter\u00fd zajist\u00ed p\u0159\u00edstupov\u00e9 porty pro po\u017eadavky:\n<ul>\n<li>rezervy \u2014 p\u0159ibli\u017en\u011b 102 zbyl\u00fdch port\u016f (22%) v hlavn\u00edch budov\u00e1ch. Pro dal\u0161\u00ed pavilony o n\u011bco v\u00edce \u2014 25%.<\/li>\n<li>video sledov\u00e1n\u00ed<\/li>\n<li>bezdr\u00e1tov\u00e1 s\u00ed\u0165<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><b>distribu\u010dn\u00ed \u00farove\u0148<\/b> \u2014 vy\u017eaduj\u00ed se p\u0159ep\u00edna\u010de s mno\u017estv\u00edm SFP port\u016f od 12 do 48 port\u016f s alespo\u0148 2 SFP+ porty, s mo\u017enost\u00ed stohov\u00e1n\u00ed a roz\u0161\u00ed\u0159enou funkcionalitou, jako\u017e i s rezervn\u00edmi bloky nap\u00e1jen\u00ed.<\/li>\n<li><b>j\u00e1drovou \u00farove\u0148<\/b> \u2014 vy\u017eaduj\u00ed se vysoce v\u00fdkonn\u00e9 p\u0159ep\u00edna\u010de od 12 do 24 SFP\/SFP+ port\u016f s podporou jak pro stohov\u00e1n\u00ed, tak pro klastry s podporou MC-LAG. Je t\u0159eba poznamenat, \u017ee je mo\u017en\u00e9 pou\u017e\u00edt i sm\u011brov\u00e1n\u00ed pro vyv\u00e1\u017een\u00ed provozu. Nejnov\u011bj\u0161\u00ed generace L3 p\u0159ep\u00edna\u010d\u016f a sm\u011brova\u010d\u016f podporuje ECMP s vyv\u00e1\u017een\u00edm provozu na 4 a v\u00edce tras\u00e1ch se stejnou metrikou.<\/li>\n<li><b>\u00farove\u0148 datov\u00e9ho centra<\/b> \u2014 vy\u017eaduj\u00ed se p\u0159ep\u00edna\u010de od 8 do 24 SFP\/SFP+ port\u016f s podporou jak pro stohov\u00e1n\u00ed, tak pro klastry s podporou MC-LAG.<\/li>\n<\/ul>\n<p>\nC\u00edlov\u00e1 sch\u00e9ma s\u00edt\u011b nakonec vy\u0161la <noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/1w\/sa\/z1\/1wsaz1id2-qf7yjjhhxspvbxepw.png\">takov\u00fd<\/a><\/noindex><\/p>\n<h2>V\u00fdb\u011br p\u0159ep\u00edna\u010d\u016f Extreme pro realizaci projektu<\/h2>\n<p>\nA te\u010f se dost\u00e1v\u00e1me k hlavn\u00edmu \u2014 chv\u00edli v\u00fdb\u011bru p\u0159ep\u00edna\u010d\u016f pro realizaci na\u0161eho projektu. Pro v\u00fdslednou c\u00edlovou sch\u00e9ma se hod\u00ed n\u00e1sleduj\u00edc\u00ed p\u0159ep\u00edna\u010de Extreme:<\/p>\n<p>\u00darove\u0148<br \/>\nModel<br \/>\nPorty<br \/>\nPopis<\/p>\n<p>j\u00e1dro<br \/>\nx620-16x-Base *<\/p>\n<p>x670-G2-48x-4q-Base*<br \/>\n16 x 10GE SFP+ <br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n48x10GE SFP+ a 4\u00d740 GE QSFP+<br \/>\nPro hlavn\u00ed pot\u0159eby j\u00e1dra:<\/p>\n<ul>\n<li>vysoce v\u00fdkonn\u00e9 linky<\/li>\n<li>roz\u0161\u00ed\u0159en\u00e1 funk\u010dnost sm\u011brov\u00e1n\u00ed a zabezpe\u010den\u00ed<\/li>\n<li>rezervn\u00ed nap\u00e1jen\u00ed pomoc\u00ed dal\u0161\u00edch nap\u00e1jec\u00edch blok\u016f<\/li>\n<li>podpora stohov\u00e1n\u00ed a klastry<\/li>\n<\/ul>\n<p>\n S minim\u00e1ln\u00edmi po\u017eadavky bude vyhovovat p\u0159ep\u00edna\u010d s\u00e9rie x620.<br \/>\n V p\u0159\u00edpad\u011b roz\u0161\u00ed\u0159en\u00fdch po\u017eadavk\u016f na po\u010det port\u016f a \u0161ir\u0161\u00ed funk\u010dnost by se m\u011bly zva\u017eovat p\u0159ep\u00edna\u010de s\u00e9rie x670-G2.<\/p>\n<p> datov\u00e9 centrum<\/p>\n<p> x620-16x-Base*<\/p>\n<p>x590-24x-1q-2c*<\/p>\n<p>x670-G2-48x-4q-Base*<\/p>\n<p> 16 x 10GE SFP+<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n24x10GE SFP, 1xQSFP+, 2xQSFP28<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n 48x10GE SFP+ a 4\u00d740 GE QSFP+<\/p>\n<p>Pro hlavn\u00ed pot\u0159eby datov\u00e9ho centra:<\/p>\n<ul>\n<li>vysoce v\u00fdkonn\u00e9 linky<\/li>\n<li>rezervn\u00ed nap\u00e1jen\u00ed pomoc\u00ed dal\u0161\u00edch nap\u00e1jec\u00edch blok\u016f<\/li>\n<li>podpora stohov\u00e1n\u00ed a klastry<\/li>\n<\/ul>\n<p>\nS minim\u00e1ln\u00edmi po\u017eadavky bude vyhovovat p\u0159ep\u00edna\u010d s\u00e9rie x620.<br \/>\nV p\u0159\u00edpad\u011b roz\u0161\u00ed\u0159en\u00fdch po\u017eadavk\u016f na po\u010det port\u016f a \u0161ir\u0161\u00ed funk\u010dnost by se m\u011bly zva\u017eovat p\u0159ep\u00edna\u010de s\u00e9rie x670-G2 a x590-24x-1q-2c.<\/p>\n<p> distribuce<\/p>\n<p> X460-G2-24x-10GE4-Base*<\/p>\n<p>X460-G2-48x-10GE4-Base*<\/p>\n<p> 24x1GE SFP, 8\u00d71000 RJ-45, 4x10GE SFP+<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n48x1GE SFP, 4x10GE SFP+<\/p>\n<p>Pro hlavn\u00ed pot\u0159eby distribuce:<\/p>\n<ul>\n<li>pot\u0159ebn\u00e9 mno\u017estv\u00ed optick\u00fdch port\u016f<\/li>\n<li>rezervn\u00ed nap\u00e1jen\u00ed pomoc\u00ed dal\u0161\u00edch nap\u00e1jec\u00edch blok\u016f<\/li>\n<li>podpora stohov\u00e1n\u00ed a klastry<\/li>\n<li>pot\u0159ebn\u00e1 L3 funk\u010dnost<\/li>\n<\/ul>\n<p>\nIde\u00e1ln\u00ed volbou jsou switche s\u00e9rie x460-G2. P\u0159\u00edtomnost redundantn\u00edch nap\u00e1jec\u00edch blok\u016f s mo\u017enost\u00ed roz\u0161\u00ed\u0159en\u00ed a p\u0159id\u00e1n\u00ed port\u016f 10G, CX (pro stohov\u00e1n\u00ed) a QSFP+ je \u010din\u00ed ide\u00e1ln\u00edmi switche pro distribu\u010dn\u00ed \u00farove\u0148 s porty a\u017e do 1 Gb.<\/p>\n<p> p\u0159\u00edstup<\/p>\n<p> X440-G2-24p-10GE4*<\/p>\n<p>X440-G2-24t-10GE4*<\/p>\n<p>X440-G2-48t-10GE4*<\/p>\n<p>X440-G2-48p-10GE4*<\/p>\n<p> 24x1000BASE-T(4 x SFP combo), 4x10GE SFP+ (PoE rozpo\u010det 380 W)<br \/>\n \u00a0<br \/>\n24x1000BASE-T(4 x SFP combo), 4x10GE SFP+<br \/>\n \u00a0<br \/>\n \u00a0<br \/>\n24x1000BASE-T(4 x SFP combo), 4x10GE SFP+ combo porty<br \/>\n \u00a0<br \/>\n48x1000BASE-T(4 x SFP combo),4x10GE SFP+ combo porty (PoE rozpo\u010det 740 W)<\/p>\n<p>Pro pot\u0159eby p\u0159\u00edstupu:<\/p>\n<ul>\n<li>pot\u0159ebn\u00fd po\u010det p\u0159\u00edstupov\u00fdch port\u016f<\/li>\n<li>podpora PoE\/PoE+<\/li>\n<li>funkcionalita a mo\u017enost roz\u0161\u00ed\u0159en\u00ed port\u016f<\/li>\n<li>dal\u0161\u00ed bonus v podob\u011b podpory stohov\u00e1n\u00ed 10Gb porty \"z krabice\"<\/li>\n<\/ul>\n<p>\nDoporu\u010duji v\u011bnovat pozornost t\u00e9to \u0159ad\u011b d\u00edky jej\u00ed flexibilit\u011b v oblasti port\u016f, v\u00fdkonu a funkcionality.<\/p>\n<p>*specifikaci vybran\u00fdch switch\u016f si m\u016f\u017eete prohl\u00e9dnout v prvn\u00edm \u010dl\u00e1nku cyklu \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/465407\/\">p\u0159ehled switch\u016f Extreme<\/a><\/noindex><\/p>\n<p>Na tomto bod\u011b bych mohl zakon\u010dit \u010dl\u00e1nek, ale r\u00e1d bych se je\u0161t\u011b v\u011bnoval dv\u011bma aspekt\u016fm, se kter\u00fdmi se ka\u017ed\u00fd in\u017een\u00fdr setk\u00e1 p\u0159i rozvoji nebo modernizaci sv\u00e9 s\u00edt\u011b:<\/p>\n<ul>\n<li>pr\u00e1ce s kabelov\u00fdmi trasami \u2014 vl\u00e1kny a m\u011bd\u011bn\u00fdmi linkami<\/li>\n<li>IP adresace<\/li>\n<\/ul>\n<p><\/p>\n<h2>Pr\u00e1ce s vl\u00e1kny<\/h2>\n<p>\nV\u00fd\u0161e jsem uvedl c\u00edlov\u00e9 sch\u00e9ma, ke kter\u00e9mu je t\u0159eba dosp\u011bt. Pro jeho realizaci je pot\u0159eba n\u00e1sleduj\u00edc\u00ed po\u010det spojen\u00ed pro za\u0159\u00edzen\u00ed:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/uj\/ru\/dd\/ujrudd7kazutmqdo9vqzzj_nmyg.png\">po\u010det spojen\u00ed<\/a><\/noindex><\/p>\n<p>Jak je vid\u011bt z tabulky, minim\u00e1ln\u00ed po\u010det vl\u00e1ken pot\u0159ebn\u00fdch k zaji\u0161t\u011bn\u00ed dostupnosti \u00farovn\u00ed s\u00edt\u011b (modul j\u00e1dra, datov\u00e9 centrum a distribuce ve dvou budov\u00e1ch) je 10 kus\u016f.<\/p>\n<p>V r\u00e1mci charakterizace s\u00edt\u011b jsme zjistili, \u017ee v kabelu mezi budovami je pouze 8 vl\u00e1ken. Co tedy v takov\u00e9 situaci d\u011blat?<\/p>\n<p>Uvedu n\u011bkolik \u0159e\u0161en\u00ed:<\/p>\n<ul>\n<li>Prvn\u00edm z\u0159ejm\u00fdm krokem je vyu\u017e\u00edt voln\u00e1 vl\u00e1kna v kabelu mezi budovou 1 \u2014 objektem 1 a objektem 1 - budovou 2 (jak je vid\u011bt z tabulky \u2014 pou\u017e\u00edvaj\u00ed se pouze 2 z 8 vl\u00e1ken v ka\u017ed\u00e9m kabelu). K tomu sta\u010d\u00ed um\u00edstit optick\u00e9 k\u0159\u00ed\u017een\u00ed mezi k\u0159\u00ed\u017een\u00edm v objektu 1 a v p\u0159\u00edpad\u011b pot\u0159eby pou\u017e\u00edt SFP moduly s p\u0159ebytkem optick\u00e9ho rozpo\u010dtu.<\/li>\n<li>Druh\u00fdm krokem je mo\u017en\u00e9 vyu\u017eit\u00ed technologie CWDM \u2014 zhu\u0161t\u011bn\u00ed nosn\u00fdch vlnov\u00fdch d\u00e9lek v r\u00e1mci jednoho vl\u00e1kna. Tato technologie je mnohem levn\u011bj\u0161\u00ed ne\u017e DWDM a pom\u011brn\u011b snadno implementovateln\u00e1. Hlavn\u00edm po\u017eadavkem jsou kvalitn\u00ed optick\u00e1 vl\u00e1kna a SFP\/SFP+ transceivery ur\u010dit\u00e9 d\u00e9lky a rozpo\u010dtu. Jak jsem ji\u017e zm\u00ednil v p\u0159edchoz\u00edm \u010dl\u00e1nku \u2014 schopnost switch\u016f rozpozn\u00e1vat transceivery od t\u0159et\u00edch stran n\u00e1m m\u016f\u017ee zna\u010dn\u011b usnadnit \u017eivot a sn\u00ed\u017eit kapit\u00e1lov\u00e9 n\u00e1klady na v\u00fdstavbu dal\u0161\u00edch optick\u00fdch kabel\u016f.<\/li>\n<li>T\u0159et\u00edm krokem je zv\u00e1\u017eit mo\u017enost zv\u00fd\u0161en\u00ed po\u010dtu vl\u00e1ken pokl\u00e1dkou dal\u0161\u00edch optick\u00fdch kabel\u016f.<\/li>\n<\/ul>\n<p>\nD\u00e1le se zam\u011b\u0159\u00edme na po\u010det vl\u00e1ken mezi budovami s nainstalovan\u00fdmi distribu\u010dn\u00edmi switchemi a dal\u0161\u00edmi sk\u0159\u00edn\u011bmi 2-10. I zde situace nen\u00ed jednozna\u010dn\u00e1:<\/p>\n<ul>\n<li>Zaprv\u00e9, chyb\u00ed vl\u00e1kna k realizaci na\u0161\u00ed c\u00edlov\u00e9 sch\u00e9matu \u2014 na ka\u017ed\u00fd switch by m\u011bly b\u00fdt 2 vl\u00e1kna (jak v\u00edme, na\u0161e kabely maj\u00ed 4 OV na ka\u017ed\u00fd sk\u0159\u00ed\u0148).<\/li>\n<li>Zadruh\u00e9, i p\u0159i dostate\u010dn\u00e9m po\u010dtu vl\u00e1ken mezi budovami, jsou uvnit\u0159 sk\u0159\u00edn\u00ed pou\u017e\u00edv\u00e1na MMF vl\u00e1kna, kter\u00e1 n\u00e1m nepovol\u00ed jednodu\u0161e propojit SMF a MMF vl\u00e1kna (m\u00e1m na mysli vzd\u00e1lenosti mezi budovami nad 300-400 metr\u016f).<\/li>\n<\/ul>\n<p>\nV takov\u00fdch p\u0159\u00edpadech m\u016f\u017eeme zva\u017eovat n\u00e1sleduj\u00edc\u00ed mo\u017enosti:<\/p>\n<ul>\n<li>Zajistit ka\u017ed\u00e9mu switchi SMF vl\u00e1kna:\n<ul>\n<li>Pokud vzd\u00e1lenost dovol\u00ed \u2014 je mo\u017en\u00e9 nat\u00e1hnout dal\u0161\u00ed dlouh\u00e9 patchcordy mezi switchem. V minulosti jsme pou\u017e\u00edvali patchcordy o d\u00e9lce 30-50 m.<\/li>\n<li>Polo\u017eit relativn\u011b levn\u00fd optick\u00fd SMF kabel s n\u00edzkou kapacitou mezi sk\u0159\u00edn\u011b.<\/li>\n<li>Jako krajn\u00ed variantu pou\u017e\u00edt r\u016fzn\u00e9 SMF-MMF p\u0159evodn\u00edky.<\/li>\n<\/ul>\n<\/li>\n<li>Pro minimalizaci pou\u017e\u00edvan\u00fdch vl\u00e1ken mezi budovami lze:\n<ul>\n<li>Vyu\u017e\u00edt funkce stakovac\u00edho switchov\u00e1n\u00ed p\u0159\u00edstupov\u00fdch switch\u016f x440-G2 \u2014 p\u0159i tom pou\u017e\u00edt jedno SMF vl\u00e1kno k ka\u017ed\u00e9mu switche na pat\u0159e, co\u017e umo\u017en\u00ed pou\u017e\u00edt m\u00edsto 6 vl\u00e1ken a port\u016f 3 vl\u00e1kna a porty na ka\u017ed\u00e9 stran\u011b.<\/li>\n<li>Pou\u017e\u00edt 2 vl\u00e1kna pro p\u0159ipojen\u00ed prvn\u00edho switche v v\u011btvi a posledn\u00edho. Agregovat linky na okrajov\u00fdch p\u0159\u00edstupov\u00fdch switch\u00edch a pou\u017e\u00edt protokoly STP v v\u00fdsledn\u00e9m kruhu.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<h2>IP adresace<\/h2>\n<p>\nZde uvedu p\u0159ibli\u017en\u00fd v\u00fdpo\u010det adresace pro na\u0161i sch\u00e9ma.<\/p>\n<p>V sou\u010dasn\u00e9 dob\u011b m\u00e1me n\u011bkolik s\u00edt\u00ed t\u0159\u00eddy B \u2014 172.16.0.0\/16. P\u0159i v\u00fdpo\u010dtu adresn\u00edho prostoru IP se budu \u0159\u00eddit n\u00e1sleduj\u00edc\u00edmi \u00favahami:<\/p>\n<ul>\n<li>4 bity druh\u00e9ho oktetu budou ur\u010dovat budovy \u2014 172.16.0.0\/12.<\/li>\n<li>3. oktet bude ozna\u010dovat \u010d\u00edslo patra v budov\u011b.<\/li>\n<li>3. oktet = 255 bude vyhrazen pro point-to-point spojen\u00ed za\u0159\u00edzen\u00ed a spr\u00e1vu s\u00edt\u00ed.<\/li>\n<li>jedna spravovac\u00ed VLAN na patro pro spr\u00e1vu p\u0159ep\u00edna\u010d\u016f.<\/li>\n<li>jedna u\u017eivatelsk\u00e1 VLAN na p\u0159ep\u00edna\u010d (v pr\u016fm\u011bru 24 port\u016f).<\/li>\n<li>jedna Voice VLAN na p\u0159ep\u00edna\u010d (v pr\u016fm\u011bru 24 port\u016f).<\/li>\n<li>jedna VLAN pro syst\u00e9m videomonitorov\u00e1n\u00ed na patro.<\/li>\n<li>jedna VLAN pro Wi-Fi za\u0159\u00edzen\u00ed na patro.<\/li>\n<\/ul>\n<p>\nM\u00e1m p\u0159ibli\u017en\u011b takov\u00e9 tabulky:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/38\/on\/b-\/38onb-zb_bxkqmlqumaun-njeok.png\">s\u00ed\u0165 172.16.0.0\/14<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/jv\/bm\/bz\/jvbmbz6iubrckcf--cicerot_1y.png\">s\u00ed\u0165 172.20.0.0\/14<\/a><\/noindex><\/p>\n<p>V tabulce v\u00fd\u0161e uv\u00e1d\u00edm p\u0159ibli\u017en\u00e9 rozd\u011blen\u00ed s\u00edt\u00ed podle budov a pater na jedn\u00e9 stran\u011b a s\u00edt\u00ed (u\u017eivatelsk\u00e9, spr\u00e1va a slu\u017eebn\u00ed) na druh\u00e9.<\/p>\n<p>Ve skute\u010dnosti v\u00fdb\u011br \u0161ed\u00e9 s\u00edt\u011b 172.16.0.0\/12 nen\u00ed optim\u00e1ln\u00ed, proto\u017ee n\u00e1s omezuje v po\u010dtu s\u00edt\u00ed (z 16 na 31) pro budovy, a p\u0159itom existuj\u00ed tak\u00e9 vzd\u00e1len\u00e9 kancel\u00e1\u0159e, kter\u00e9 tak\u00e9 pot\u0159ebuj\u00ed rozd\u011blovat bloky s\u00edt\u00ed. Mo\u017en\u00e1 optim\u00e1ln\u011bj\u0161\u00edm \u0159e\u0161en\u00edm bude pou\u017eit\u00ed s\u00edt\u00ed 10.0.0.0\/8, nebo spole\u010dn\u00e9 vyu\u017eit\u00ed s\u00edt\u00ed 172.16.0.0\/12 (nap\u0159\u00edklad pro slu\u017eebn\u00ed \u00fa\u010dely a servery) a 10.0.0.0\/8 (pro u\u017eivatelsk\u00e9 s\u00edt\u011b).<\/p>\n<p>Celkov\u011b je p\u0159\u00edstup k vymezen\u00ed IP s\u00edt\u00ed tak\u00e9 modul\u00e1rn\u00ed a je \u017e\u00e1douc\u00ed dodr\u017eovat pravidla sumarizace pods\u00edt\u00ed do jedn\u00e9 summary s\u00edt\u011b na \u00farovn\u00edch distribuce, stejn\u011b jako na hrani\u010dn\u00edch routrech v odlehl\u00fdch pobo\u010dk\u00e1ch. D\u011bl\u00e1 se to z n\u011bkolika d\u016fvod\u016f:<\/p>\n<ul>\n<li>pro minimalizaci sm\u011brovac\u00edch tabulek na routrech<\/li>\n<li>pro minimalizaci provozu slu\u017eebn\u00edch protokol\u016f (r\u016fzn\u00e9 aktualizace, p\u0159i nedostupnosti vno\u0159en\u00fdch pods\u00edt\u00ed)<\/li>\n<li>pro zjednodu\u0161en\u00ed spr\u00e1vy a lep\u0161\u00ed \u010ditelnost L3 s\u00edt\u00ed<\/li>\n<\/ul>\n<p>\nI kdy\u017e u prvn\u00edch dvou bod\u016f je t\u0159eba poznamenat, \u017ee v\u00fdkon modern\u00edch routrech je mnohem vy\u0161\u0161\u00ed ne\u017e u t\u011bch, kter\u00e9 byly p\u0159ed 15-20 lety, a umo\u017e\u0148uj\u00ed uchov\u00e1vat ve sv\u00e9 opera\u010dn\u00ed pam\u011bti velk\u00e9 sm\u011brovac\u00ed tabulky, a pom\u011br ceny a propustnosti komunika\u010dn\u00edch kan\u00e1l\u016f se ve srovn\u00e1n\u00ed s cenami z dob masov\u00e9ho pou\u017e\u00edv\u00e1n\u00ed E1\/T1 (G.703) sn\u00ed\u017eil.<\/p>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>\nP\u0159\u00e1tel\u00e9, v tomto \u010dl\u00e1nku jsem se pokusil co nejstru\u010dn\u011bji p\u0159ibl\u00ed\u017eit z\u00e1kladn\u00ed principy n\u00e1vrhu kampusov\u00fdch s\u00edt\u00ed. Ano, materi\u00e1lu je pom\u011brn\u011b hodn\u011b a to p\u0159esto, \u017ee jsem se nap\u0159\u00edklad nezab\u00fdval takov\u00fdmi t\u00e9maty jako:<\/p>\n<ul>\n<li>organizace hranice podniku (to je samostatn\u00fd p\u0159\u00edb\u011bh se sv\u00fdmi p\u0159ep\u00edna\u010di, br\u00e1nami, firewall, IPS\/IDS syst\u00e9my, DMZ, VPN a dal\u0161\u00edmi z\u00e1le\u017eitostmi)<\/li>\n<li>organizace Wi-Fi s\u00edt\u00ed<\/li>\n<li>organizace VoIP s\u00edt\u00ed<\/li>\n<li>organizace datov\u00fdch center<\/li>\n<li>bezpe\u010dnost (to je tak\u00e9 sv\u016fj vlastn\u00ed sv\u011bt, kter\u00fd objemov\u011b a po\u017eadavky nijak nezaost\u00e1v\u00e1 za n\u00e1vrhem \u010dist\u00e9 s\u00ed\u0165ov\u00e9 infrastruktury, a n\u011bkdy ji dokonce p\u0159evy\u0161uje)<\/li>\n<li>energetika<\/li>\n<li>seznam by mohl pokra\u010dovat a pokra\u010dovat<\/li>\n<\/ul>\n<p>\nVe skute\u010dnosti je n\u00e1vrh a v\u00fdstavba s\u00edt\u011b podniku pom\u011brn\u011b pracn\u00fd \u00fakol, vy\u017eaduj\u00edc\u00ed zna\u010dn\u00e9 mno\u017estv\u00ed \u010dasu a zdroj\u016f.<\/p>\n<p>Ale douf\u00e1m, \u017ee v\u00e1m m\u016fj \u010dl\u00e1nek pom\u016f\u017ee zhodnotit a na z\u00e1kladn\u00ed \u00farovni porozum\u011bt, jak se k tomuto \u00fakolu p\u0159istupovat.<\/p>\n<p>Toto rozhodn\u011b nen\u00ed posledn\u00ed \u010dl\u00e1nek o <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/extreme\">Extreme Networks<\/a><\/noindex>, tak\u017ee sledujte aktualizace (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/475332\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c, \u0434\u0440\u0443\u0437\u044c\u044f! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0443 \u0446\u0438\u043a\u043b, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u043c Extreme \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0441\u0435\u0442\u0438 Enterprise. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u043f\u043e\u0441\u0442\u0430\u0440\u0430\u044e\u0441\u044c \u043f\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0430\u0442\u043a\u043e: \u043e\u043f\u0438\u0441\u0430\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0441\u0435\u0442\u0438 Etnterprise \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u0438\u0434\u044b \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0432\u0430\u0436\u043d\u0435\u0439\u0448\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0441\u0435\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u2014 \u043e\u043f\u043e\u0440\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 (ip-campus) \u043e\u043f\u0438\u0441\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u043e\u0438\u043d\u0441\u0442\u0432\u0430 \u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0440\u0435\u0437\u0435\u0440\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 \u0441\u0435\u0442\u0438 \u043d\u0430 \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0442\u043d\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0441\u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\/\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52795","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c, \u0434\u0440\u0443\u0437\u044c\u044f!\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. \u0414\u0438\u0437\u0430\u0439\u043d \u0441\u0435\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043d\u0430 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445 Extreme | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c, \u0434\u0440\u0443\u0437\u044c\u044f!\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-16T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:00:35+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. N\u00e1vrh s\u00edt\u011b podniku na p\u0159ep\u00edna\u010d\u00edch Extreme | ProHoster","description":"Dobr\u00fd den, p\u0159\u00e1tel\u00e9!","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. \u0414\u0438\u0437\u0430\u0439\u043d \u0441\u0435\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043d\u0430 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445 Extreme | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c, \u0434\u0440\u0443\u0437\u044c\u044f!","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-dizajn-seti-predpriyatiya-na-kommutatorah-extreme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-16T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52795","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:37:30","updated":"2026-01-24 04:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=52795"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52795\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=52795"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=52795"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=52795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}