those are some seriously secure routers.

Here's a clear shot of the wireless hardware.  It's somewhat hard to see in the earlier pictures...



All four devices are somewhat more visible in this shot.


On the left side of the rack is a Cisco 1231G-A-K9.  The top two antennas are 2.4GHz antennas running 802.11b and 802.11g.  The big square antenna on the bottom center runs 802.11a.


On the right side of the rack is my old Cisco 1220B-K9.  It only runs 802.11b from the two antennas on top.


The left-center access point is my shiny new Cisco 1242G-A-K9.  The top two antennas run 5.0GHz 802.11a and the bottom two run 2.4GHz 802.11b and 802.11g.  The small AP in the back is Cisco 350B which only runs 2.4GHz 802.11b from its two antennas.




The Cisco 350B and 1220B are only turned on when I need them for my lab, which is somewhat rare.  The newer and more powerful 1231G-A-K9 and 1242G-A-K9 run 802.11a/b/g and are running constantly as redundant pairs.  They each serve three SSIDs tied to my three primary VLANs.  Two SSIDs run WPA2-Enterprise for my internal and lab networks, and one SSID runs WPA2-PSK for the "guest/gaming" network.  Channels are automatically negotiated, with the two live AP's choosing between the non-overlapping channels 1, 6, and 11.


-b0b
(...got root?)

I've bought some new toys for the network!  I've got a fairly drastic perimeter redesign coming up in the next week or two to implement this stuff.  Ultimately, my goal is to provide VPN access to everyone by the end of the year.  Nothin' says sexy like a 256-bit AES VPN connection!

I haven't taken pictures of the new gear yet, so forgive the stock/borrowed pics:



First up, I bought this AIM-VPN/HPII-Plus card for my existing router.  Cisco made a total of nine encryption cards for the 3745 router, of which this is the most powerful and feature-rich.  It will allow me to support AES VPN tunnels in 128-bit and 256-bit flavors.



These bad boys will become the core of my network security strategy.  These are Cisco PIX 525 firewalls that operate as a failover bundle.  I've maxed them out with 512MB of PC100 ECC SDRAM and have upgraded them with the latest OS and management software.  



In addition to maxing out the RAM, I've added five more network interfaces to each PIX along with this bad boy.  The Cisco PIX-VAC-PLUS serves a similar role to the AIM-VPN/HPII-Plus above and offloads encryption duties from the CPU.  It increases the VPN throughput of the PIX 525 from 30Mbps to ~145Mbps.



For intrusion prevention, I picked up a Cisco IDS 4215.  This device sits inline and monitors all traffic that passes through the network, looking for known-bad traffic.  Think of it as network-based antivirus/anti-malware/etc. device that also looks for attack signatures (hacking attempts, port scanning/reconnaissance/etc).



Finally, I picked up this bad boy to terminate VPN connections.  It's a Cisco 3030 VPN concentrator.  Fully loaded, it is capable of supporting up to 10,000 VPN connections.  Somehow, I don't think we'll need quite that many.

X wrote on Oct 18^th, 2010 at 5:44pm:


I have a rather large window air conditioner that serves no other purpose than to keep my office at a balmy 66 degrees all year around.  That said, I'm not sure just how much all of this new equipment will affect the overall heat in the room.  Most of that equipment operates at 35-55 watts, so thermal output shouldn't be too crazy.  I bet all of my production network gear will only consume 50% of the power (and, thus, produce half the heat) that the Bobulator draws.


-b0b
(...and just wait until I build the next Bobulator!)