Is the Distribution Layer Still Needed?

arnie_apesacrappin wonders: "I'm in the process of designing the network for a new building in what I would consider a small to medium sized company. It is on the scale of tens of access layer switches, not hundreds. There is a ongoing argument about the need for a distribution layer. My position is that with today's layer 2/3 switches in the core, the distribution layer is outdated for a network of this size. The layer 2/3 core can provide all the aggregation services of the old distribution layer and the routing/filtering functionality of the core with better price and performance. My opponents can only argue that having a distribution layer is the standard. So, are there good reasons for having a distribution layer in a small to medium network? If you were going to argue against the distribution layer, what points would you make?"

Comments

It can be done.

[FreeLinux]

Removing the distribution layer is perfectly possible. The main requirement though, is having sufficient processing power and redundancy on the core to handle the access layer's connections.

Basically, if you eliminate distribution, you have to have a lot more processing power and lots more ports in the core. Depending on the network's size and distribution it will probably be more costly to build such a robust core. Also, don't forget that this thing is certain to grow. Can it scale easily and cost effectively with the more robust core? There will come a point that it will not scale effectively and the distribution layer will have to be introduced.

Layer 3 Switch?

[adamjaskie]

The fuck is a layer 3 switch? I keep hearing this term. I was taught that hubs work on Layer 1 (physical), switches on Layer 2 (data link layer - i.e. dealing with MAC addresses) and routers on Layer 3 (network - i.e. dealing with IP addresses). Is "Layer 3 Switch" just cisco for what everyone else calls a "Router"?

Depends on how you define "distribution layer"

[dtfinch]

We just have a stack of 24 port gigabit switches. 4 ports on each switch is set up as a trunk to connect them together, effectively turning them into one giant, fast, very cheap gigabit switch. Looking at the Cisco diagram, this might be considered our distribution layer.

We normally have one port on the switches for each system, with the exception that in some locations we have smaller switches to allow them to share a line, so that we don't have to rewire the building. We also use some smaller switches as repeaters to parts of the building too far away to connect directly to the central switches. Those small switches outside of the server room, along with all our servers and systems, might be considered our access layer.

Then we have a tiny linksys router, intended for home use, connecting the entire building to the internet. I know, it sounds scary, and unprofessional, but it seems plenty capable of filling the bandwidth of a T1 and tracking as many simultaneous tcp connections as we use. We'll consider replacing it at the first sign of trouble. I guess this is our core layer.

I suppose that whatever you use at the top level to connect your systems to create a single network can be called your distribution layer. The switches may get cheaper over the years, but it's the same thing. If you just have a chain of 8 port switches running around the building, then your distribution layer is a bunch of 8 port switches.

However you design your distribution and access layers, your main goals should probably be to minimize line problems (mostly due to distance) and avoid bottlenecks. You seem concerned about price, so if you decide to use 100mbit switches to keep the price down, I recommend that get the kind that have gigabit uplinks and plug them into a gigabit switch, and plug your servers into the gigabit switch as well. Otherwise, your effective bandwidth will be 100mbit total rather than 100mbit per user.

Re:Spoken like a true CCNA

[benjamindees]

I've had experiences that negate both of these presuppisitions. At the small University where I went, I literally watched the ethernet equipment being installed. I then used it to do most of my assignments via a remote X session to the lab computers, from my dorm room. Professors looked at me dumbfounded when I told them why I wasn't attending labs any more. They wondered what I had "hacked" in order to be able to do that.

When I applied for a job at the same University as Network-something-or-another years later, they wanted someone with Cisco certs. I'm not sure if they even had more than a couple of pieces of Cisco equipment. I wrote a nice cover letter detailing my experience, and how it was not Cisco-specific, but was isomorphic to Cisco-specific concepts. I assumed that they, working for a *University*, would understand the difference between branded jargon and universal concepts. I made a point to ask for quite a bit less than what any self-respecting Cisco certified tech would ask for. I made it clear that I was a quick learner and quite flexible in my capabilities. What I got was a call back asking if I had a Cisco cert :)

On the other hand, though, try asking a professor how encryption works someday. You'll get a basic explanation of how data can be represented as ones and zeros, and by adding a key, you can obfuscate the message, and the receiver can subtract the key to get the original back. Anyone with a tenth grade education can understand that. Hell, most tenth graders could *implement* that. Now, I defy anyone to explain to the average person how to implement this simple concept with, say, OpenSSL, without using a lot of buzzword-laden crap.

There are idiots who know nothing but repeating technical jargon almost everywhere nowadays.

Re:Your network is too small.

[Dr.Dubious DDQ]

And when the crappy consumer grade stuff fails they can swap in a new one for cheaper than two weeks maintenance on a cisco box.

And that, in a nutshell(tm), is what I absolutely hate about the "high end" stuff. The fact that the up-front cost to gain ownership of the physical device is one thing, but the hefty recurring fees to get ANY kind of support (including, as far as I can tell, bug-fixes, security updates, and so forth) get insane very quickly. Especially when you're presumably willing to pay the premium "ownership" price because the device should then not NEED much of anything in the way of "maintenance" to keep it running. I've come to think of this as just another "protection" racket - "Nice network you've got, and such an expensive router. it sure would be a shame if someone happened to find a security flaw and you didn't have access to updates, wouldn't it?" Taking that into account, it may often cost LESS to just replace the "consumer grade" stuff as it fails that it costs to keep paying "maintenance" fees on the expensive stuff.

I've gotten quite irritated with Cisco on this front - I picked up a Cisco 768 DSL router to replace the "Actiontec" piece of junk that the phone company was renting out. I went to Cisco's website to check for updated firmware and so forth, and got told "you have to register to see this". So, I went and gave out all the precious marketing information (name, address, phone number, blood type, shoe size, etc. etc. etc.), finally got to the end of the "registration" process, and got "Ha, ha, sucker, you STILL can't see this stuff because you're not a 'paid support' user or a 'Cisco partner'...". Thanks, Cisco, thanks a lot.

(On the upside, the router HAS been very reliable so far...and doesn't decide to just stop routing packets for no good reason until rebooted like the Actiontec modem did...)

Re:Spoken like a true CCNA

[WgT2]

I love the irony you bring to light about university settings.

One would think those working for and under university level expectations, and job applications requiring EVERY-SINGLE-JOB-YOU-EVER-HAD to be listed with it, to be somewhat on the ball about how to do things, at least efficiently.

But, no.

What is often forgotten is that universities are rarely anything less than a bureaucracies. Therefore you, as I and my classmates, might get a "Unix Administrator" who is unaware of the web interface to their server's email service (squirrelmail) and instead give a crash course on Pine to a group mostly Windows raised neophytes without giving them the basic, yet amazingly helpful, courtesy tip on using "tab completion" on BASH's command line! (That last point would make a good interview question or grounds for dismisal, in my book, for an 'Admin' titled position.)

I guess the ultimate irony is that the skills universities 'intend' to teach are actually the ones that, hopefully for me, helped the very people who implimented such things as 'tab completion' and using telnet to port 25 to send email. So, all is not lost for attending such institutions. It's the bureaucracy on the backend that slows 'em down.