Moving Bits and Bytes – Facility Networking Made Easier

October 13, 2020

Learn to use VLANs, link aggregation and more to manage high performance networks for post production, using Ubiquiti products.


Update

Hi everyone – Just a quick update to this Insight  – Recently, Ubiquiti’s latest software update changed the look and feel of the new settings menu. All of the instructions below still apply – but a few things may be in a slightly different location. The bulk of the work is done in the ‘Classic Setttings’ menu – which remains unchanged in the latest firmware.

-joey

Building A Robust Facility Network

Whether you are working at a small facility, or even working at home – In the current world of computer driven post production, online review and approval, and tapeless file based workflow – IT and networking has never been more important.

If you are at a large facility or network – you probably haven’t had to think about networking, but for those running their own shops, working at small shops or even setting up a home system for remote work – having your networking and IT infrastructure in good order can make a huge difference.

Over the years I’ve managed the IT networks of post houses both small and large – but these days, I’m working almost exclusively from home. This means my network here has evolved from “just plug everything into the router that came with my internet connection” – to a hodgepodge of various equipment I bought as needed, and now finally to a tightly managed and setup professional network.

In this article I’ll walk you through how I’ve got my network configured – and along the way explain a lot of networking concepts important for post-production.

The Requirements

Before getting into any kind of networking – it’s best to sit down and think about what you actually need, so you can plan for everything. Take some time thinking about this stuff – because trust me, you will always forget something along the way. For my setup, the goals were:

  • Integrate all networking components into the same ecosystem of products – so management would be easy and in a single place
  • Move my shared storage from a series of direct connections to the NAS servers, to a switched high speed 10G network
  • Have reliable, full WiFi coverage everywhere
  • Separate my home network from the production network, both for management and security
  • Guest WiFi – separate from everything so clients stay sandboxed
  • Add security cameras to monitor outside and my machine room
  • Add additional separate networks for some other specific needs (In my case – a dedicated network for lighting control of my house)

Thinking about it, its a big list! So I had to make sure the equipment I was buying was expandable and robust enough to handle all of that – plus anything I forgot along the way.

The Gear

I chose Ubiquiti for my facility and home network. Having everything managed in one place, from one dashboard – was a huge selling point.

So what did I buy? Well if you’ve talked to me about networking any time in the past year you won’t be surprised – I decided to replace everything with gear from Ubiquiti Networks. They are a relative newcomer to the networking world having been founded in 2005, but they have built an impressive portfolio of networking products. The biggest draw for me was that everything they make integrates tightly into a single management console – with all configuration, settings, deployment, and even firmware updates coming from one easy to use web-based management console.

I think you’ll see why I love the Ubiquiti ecosystem of products, and I feel having my network set up in such a robust way has helped me work faster and smarter. That said – these concepts apply to just about any managed switches/infrastructure – so don’t assume you need to re-buy everything you already own, or lock yourself into a single vendor!

Most managed switches will let you easily configure VLANs and link aggregation – you’ll just need to do it from that switch’s management page. VLANS, link aggregation, jumbo frames are all cross-platform concepts, they aren’t vendor-specific – so you don’t need to be locked into a single company or product line.

I also want to mention that I have absolutely zero relationship with Ubiquiti except as a happy customer. All of this gear was bought retail, with my own money.

Network Structure

When it comes to the actual structure of your network – where things are plugged into what – you may find that this is limited by factors like where you can run cable, where your internet connection comes in, etc. For me, that was definitely the case. In my house I have:

  • A basement color suite, with an adjacent equipment room. The equipment room is where the internet connection comes in,
  • A closet on the other side of the suite
  • Cat5E home runs in every room of the house, that end in the closet in the basement

This meant a few things – I had to put switches both in my equipment room, and in the closet (which I now consider a networking closet) – to distribute network around the house – and I had to run cables between them. Luckily – my suite has drop ceilings so those runs weren’t very difficult.

Breaking It Down

So this is where I ended up. Keep in mind – I fully recognize this to be absolute, complete and total overkill. You likely won’t need this much gear. I just really enjoyed building out such a robust network – and I think it will be relatively future proof!

A tree layout of all my network components.

Going down the individual components, we have:

  • The Unify Dream Machine Pro (or UDM). This is the main controller that manages the entire network, and where my ISP connection comes in. Everything starts here.
  • The UDM then connects to a 24 port rack-mount switch in my equipment rack, where lots of other components are plugged into.
  • A 10G switch connects to the 24 port switch, and then to all 10g capable components, like my 2 NAS servers, my VMWare server, and my 2 workstations and assist station. One important thing to know – this switch uses mostly SFP+ ports, which require transceivers to connect to RJ45 ports. These transceivers are manufacturer specific and won’t work in all types of switches, so make sure you buy the right ones! I used these from 10GTek, and they’ve been working well.
  • From the 24 port switch, connections go out to a small PoE switch I have inside my desk, and to a bigger PoE switch in the network closet
  • From the network closet – PoE lines go out throughout the house. These both power and feed the wireless access points.
  • I also have 2 additional small switches – one in my garage, and one upstairs to connect consumer stuff like the TV, streaming boxes, etc
  • 3 Nano APs, and one outdoor Mesh AP for wireless access.

The cool thing about PoE and Ubiquiti networking gear – is to add many of these components, it’s as simple as plugging them in! The UDM will recognize them, and ask you if you want to “adopt” them into your network. From there they are automatically updated and provisioned, and then usable quickly. One more cool thing? Since PoE ports are managed from the switch – they can be power cycled from the Ubiquiti interface!

A quick PoE restart can be a timesaver for finicky gear like VoIP phones.

I have a VoIP phone that has a bad habit of locking up every so often – so it’s nice to be able to power cycle it without having to unplug/replug.

Dream Machine? Router? DHCP? Firewall? Network Controller? What is all this stuff?

The Dream Machine Pro is the core of my Ubiquiti network

So let’s start at the very beginning of the network – the Dream Machine Pro. This is what most people would call the “router”. However people use “router” as a sort of catch-all term for network appliances/devices that do a lot of different functions. Most people have gotten so used to these features being all on one box, but they are actually separate things. The Dream Machine handles the following roles:

  • Network Controller – this is specific to the Ubiquiti ecosystem. The software running on the UDM is what controls all the other components on the network, and gives you a “single pane of glass” style of management and monitoring for all aspects of the network.
  • Router – The router controls all traffic in, out and between networks. This means your main internet connection plugs into the UDM’s WAN port, and in most cases will get a single IP address via DHCP from your ISP. From there, the router will route all traffic in and out of your internal networks to and from the internet.
  • DHCP Server – The UDM has a built-in DHCP server, which assigns addresses automatically to devices joining the network.
  • Firewall – The firewall controls access in and out, and between networks in the system.
  • Camera DVR – The Dream Machine actually has a cool little bonus feature. You can add a SATA hard drive, and it will also work as a DVR for networked security cameras.

The Dream Machine packs a ton of functionality into one device, and has enough power to scale up to some pretty large networks. The UDM can totally replace the router/modem that comes with your ISP.

One important thing to remember especially if you are setting this up for home office use – many residential cable/fiber ISPs that also provide TV service actually run all the networking for set-top boxes through legacy cable wiring over MoCa. This means removing their router may break your TV set-top boxes! Thankfully this is easily remedied by adding in a cheap MoCa bridge – to restore that capability if needed.

Member Content

Sorry... the rest of this content is for members only. You'll need to login or Join Now to continue (we hope you do!).

Need more information about our memberships? Click to learn more.

Membership options
Member Login

Are you using our app? For the best experience, please login using the app's launch screen


Comments

Homepage Forums Moving Bits and Bytes – Facility Networking Made Easier


  • Jason Bowdach
    Guest

    Fantastic article and perfect timing! Thanks Joey.


  • Carey D
    Guest

    Hey Joey, Thanks for sharing this. I too reinvented my network around a bunch of Ubiquiti stuff over the past few iterations including a major upgrade this past Jan/Feb to UDM pro and new/better switching. Love it. Anyone reading this needs to know that if you have a 1Gigabit or faster internet connection and don’t run a router at least as powerful as the UDM Pro then you are almost certainly suffering performance bottlenecks. Such was the case with my previous USG from Ubiquiti.

    My topology is somewhat different and I still have some non Ubiquiti gear in the network, but loving what they have to offer and the management so over time it’s gone mostly Ubiquiti. Example: My 10G corporate LAN is airgapped, but your VLAN tips may have prompted me to alter that. But I can still administer the two 10G-connected Qnap NAS boxes from the whole network because their 1G ports are connected to my main LAN with internet.

    Anyway, thanks and I echo your endorsement of the “Ubiquiti” way. LOL.


  • Joey D’Anna
    Guest

    Nice! yea I really think the VLAN with firewall rules is the way to go. If your 10G network is airgapped, but the NAS boxes have 1G connections to your main IT LAN – they aren’t actually airgapped. If someone or some malware compromised a machine on your normal 1G LAN, they would still have a way in to the 10G LAN via the NAS servers 1G connection.

    I was set up the same way before – and that risk was one of the main reasons i went this direction. Now the only way into the production network is via a switch port intentionally tagged for that VLAN. The only thing i allow in is the HTTPS web management to monitor my NAS servers, which I feel is relatively low risk.


  • Carey D
    Guest

    Hey Joey. Agreed on airgapped and expected you to flag that as I typed it! …and I’m going to be making some changes as soon as I can.


  • Zeb C
    Guest

    Any bandwidth control in the Ubiquiti kit? Just for limiting things from your personal network so they don’t hit your business network speeds?


  • Mel M
    Guest

    Hey Joey, thanks for this great article! Does the Dream Machine have any UTM capabilities, or are you using something else for that?

    I’m looking to replace a crappy old Sonicwall TZ215 router that pretty much turns our high speed fiber internet into an ISDN line when the UTM functionality is enabled. So I’ve had to disable all those features just so we can download/upload client files with a decent speed, which kinda spooks me out.

    I’ve had people suggest Untangle or pfSense routers, and I’ve also been hearing a lot of good things about the Dream Machine. It’s hard to pick which one will work best for my needs. I really just need something that can do UTM and DPI without slowing our 100 Mb fiber (w/5 users on the network) down, so I’m was wondering if the Dream Machine would still be a good choice?


  • Joey D’Anna
    Guest

    Hey Mel – no, the UDM doesn’t look like it supports UTM (Had to look it up – I’ve never used UTM before, but I have used the bigger sonicwall products at a previous post house and was very happy with them).

    The UDM does do deep packet inspection, but its based on their own stuff – just not on a standard like UTM. It does have a pretty nice array of options available from mild to wild in terms of what to do/block with the DPI, but yea if you are looking specifically for UTM – it probably isn’t the way to go.

    So the udm pro does have a wide suite of security features built in. (just not UTM based) – and enabling them wont cause any internet throttling for 1gig and lower connections – so your 100mb fibre would be no problem for it to handle. You just may not have the same security options you are used to with the sonicwall.


  • Joey D’Anna
    Guest

    Hey Zeb! – yes, the Ubiquiti switches all support QoS settings for prioritizing traffic. However I haven’t set this up myself, since all of the main work stuff is already physically separated on a dedicated 10g switch. So any traffic happening on the main 192.168.0.0 network will be on the 1g switching infrastructure, and all my work stuff on 10.0.2.0 will is internal to the 10g switch – and the 2 will never interfere with each other.

    the only issue would be total internet bandwidth – if a device on the 192 net was dominating my entire gigabit pipe while i had to upload a huge file for a client – that could be an issue. However in my setup it hasn’t really come up yet, as most consumer/home internet use is download only – and deliveries are upload only, I haven’t had much reason to try and optimize QoS so far. Furthermore most of the 192 clients are on WiFi and couldn’t overload my internet if they wanted to!

Log in to reply.

1,000+ Tutorials to Explore

Get full access to our entire library of over 1,100+ color tutorials for an entire week!


Start Your Test Drive!
Loading...