Catalyst for Better Network Management

Catalyst for Better Network

Management”>

Cisco Systems Inc.s latest addition to the Catalyst 3550 family, a 24-port 10/100M-bps switch with two Gigabit Ethernet Interface Converters, is a solid choice for midsize to large organizations looking to reduce IT costs through improved network management.

In tests at eWeek Labs, we found that the latest twist on the Catalyst 3550—which was also released in a 48-port form factor this month—is a formidable challenger to products such as Extreme Networks Inc.s Summit 24 because it combines wire-speed performance with easily configured port-level security. The Catalyst 3550 also ups the ante by adding a slew of other security and management features, including sophisticated port mirroring for switch analysis, EtherChannel protection, Internet Group Management Protocol filtering and new controls for password recovery.

Before IT managers jump on the every-switch-a-point-of-management bandwagon, we recommend that both the network management infrastructure and the budget be in place. Putting Layer 3 and Layer 4 QOS (quality-of-service) and traffic controls in a wiring closet switch adds layers of responsibility for initial configuration and ongoing maintenance.

Our tests showed that even though the new configuration wizards and the slick GUI (we hear groans from the command-line aces) will reduce the pain of configuration, it still takes at least a midlevel network technician to design the best configuration for these tools.

Furthermore, the Catalyst 3550-24, which started shipping in January, costs $3,495 with the standard management image (software that provides the new management capabilities) and $5,490 with the enhanced software that came with the hardware we tested. In comparison, the Summit 24 costs $3,495.

These costs, the outright price of the equipment, and the anticipated configuration and maintenance costs should be weighed carefully against any savings that could accrue from improved bandwidth and security management. The future-proofing Gigabit Ethernet Interface Converter interfaces that make uplinking to a Gigabit Ethernet backbone a possibility over copper or fiber media must also be taken into account.

These are long-term trade-offs that network managers should carefully weigh. In some cases, lesser Cisco or competitive gear will do if network traffic is expected to remain stable and is already reasonably well-protected, as in call centers.

Because the Catalyst 3550-24 switch provides a number of Cisco firsts in this class of product—including advanced QOS, rate-limiting capabilities, security access control lists, multicast management and IP routing—network managers also have far more flexibility when designing networks than they previously had when using Ciscos fixed configuration switches.

We used the new features, which were quite easy to configure, to push additional security further from the edge of the test network than we were able to in previous tests of Cisco equipment. For example, we were able to configure our test switch to allow only a set of authorized users to send traffic over the switch with the Cisco security access control lists.

This increased the short-term costs associated with setting up the Catalyst 3550-24 because it meant that we had to spend several hours thinking through the ramifications of adding these security measures to the switch.

The flip side of these costs is that the rate-limiting capabilities of the Catalyst 3550-24 made it possible for us to stop potential traffic problems before they started. Controlling the volume of network traffic control at the local level could be a real boon for organizations that have large numbers of expensive WAN links.

In fact, Ciscos increasing use of a GUI-based configuration management system can only mean a reduction in the time (and, in some cases, a lower level of expertise) required to maintain the advanced Catalyst 3550 switch line.

This is not to say that the cryptic CLI (command-line interface) is about to go away. Advanced network engineers will justify their mastery of the arcane CLI because there are too many times when nothing short of a batch file and hard-won experience will solve the routing and switching problems that advanced switches such as the Catalyst 3550-24 will bring to the front lines.

Hidden Problems

Our tests showed that Cisco did a fair job of putting big-time features in a midsize, stackable switch that is suitable for most wiring closets.

Switches are notorious for making network problems difficult to find by hiding traffic. The Catalyst takes an old trick—port mirroring (duplicating the traffic from one port and sending it to a management port)—and gussies it up, calling it SPAN (Switched Port Analyzer). We could pick and choose with ease the ports that we wanted to monitor using Fluke Networks Inc.s OptiView Integrated Network Analyzer to test how well ports could be monitored with third-party products.

There were some drawbacks. We were able to use the SPAN only on ports that were in the same VLAN (virtual LAN). Using SPAN was disallowed when we tried to employ some of the port security features now found in the Catalyst 3550-24.

Using Cisco Cluster Management Suite, a standard feature in the line, we could easily configure per-port security policies. For example, unlike previous versions of the software, we could specify a greater range of actions when illegal packets were found on the port. Whereas before, the port would just shut down, the 3550-24 let us specify that the offending packets be dropped or that an SNMP alert be sent.

We used access control lists to finely control allowed data on the VLANs we designated on the Catalyst 3550-24. This is one area where we really noticed that with power comes a heavy management responsibility. We kept thinking of the future network administrators who would have to come back and peer into our handiwork to figure out why someone was or wasnt getting access to the network.

Senior Analyst Cameron Sturdevant can be contacted at cameron_sturdevant@ziffdavis.com.

Catalyst 3550

-24 Switch”>

Catalyst 3550-24 Switch

The Catalyst 3550-24 switch, part of Ciscos Intelligent Ethernet Switch line, is a solid performer, both as a capable wire-speed switch with lots of QOS and security features and as a highly manageable wire-closet workgroup switch.

SHORT-TERM BUSINESS IMPACT // Even though the Catalyst 3550-24 has handy new wizards, IT managers must still plan on extensive initial configuration—and thus, a significant implementation cost. The payoff is an increase in security and greater control over network traffic.

LONG-TERM BUSINESS IMPACT // To gain long-range savings, IT departments should ensure that configurations are periodically reviewed and that a strategy for ongoing maintenance is factored into the overall cost of the Catalyst 3550-24.

PROS // Shifts security and QOS decision making much closer to the desktop.

CONS // Significant configuration and maintenance costs; SPAN port-mirroring feature is limited.

Cisco Systems Inc., San Jose, Calif.; (800) 526-7208; www.cisco.com