Main

h1. Router and Network Setup

I started my foray into custom networking using DD-WRT running on a Linksys WRT3200ACM. This worked well for a while but I noticed performance issues as my network grew. In October 2019 I decided to go all in and setup a pfsense router.  And then in 2021 I switch to an OPNsense based router.

h2. Router

!hp_elitedesk_800_G2.jpg!

* "HP EliteDesk 800 G2 SFF Desktop PC":https://support.hp.com/us-en/product/hp-elitedesk-800-g2-tower-pc/7633297/document/c04786146

* Intel Core i5-6600T (quad core @ 3.3 GHz; upgraded from i5-6500)

* 8GB RAM 

* 128GB SSD HDD 

* Intel quad port 1G NIC

* Mellanox MCX354A-FCCT (40GigE)

* Running "OPNsense":https://opnsense.org/ :  23.7.9 (based on FreeBSD 13.2)

| *Interface* | *MAC*| *Reserved IP* | *Notes* |

|WAN   (em4)               |dc:4a:3e:81:f5:49|10.0.0.188               |attached to DMZ on FIOS router|

|CopperLAN (mlxen0) |e4:1d:2d:dc:9b:b1|192.168.1.1 (static) |top port of Mellanox NIC|

|FiberLAN    (mlxen1)  |e4:1d:2d:dc:9b:b2|10.250.1.1 (static)  |bottom port of Mellanox NIC|

* em0 (top port) - em3 are the Intel 1G quad port interfaces

* em4 is the built in motherboard NIC

h2. Main Switch

!{width:30%}icx6610-24p-pe-900x900.jpg!

Main switch: "Brocade ICX-6610-24P":https://webresources.ruckuswireless.com/pdf/datasheets/ds-icx-6610.pdf

* 24 port 1000-BaseT POE ports

* 8 SFP+ (10G) ports

* 2 QSFP (40G) ports

* 2 QSFP (4x10G breakout) ports

h3. Configuration

The network is subdivided into CopperLAN which is 1G copper and FiberLAN which is 10G fiber:

* *CopperLAN*

** 192.168.1.1/16

** Switch ports: 1/1/1-1/1/24; 1/2/1 (40G router uplink)

** VLAN 10

* *FiberLAN*

** 10.250.1.1/24

** Switch ports: 1/3/1 - 1/3/8; 1/2/6 (40G router uplink)

** VLAN 20

h3. Port Connection Table

h4. CopperLAN

| *Port* | *Device / Branch* |

| 1      | living room - top port - AP (POE enabled)    |

| 2      | downstairs bedroom and rec room|

| 3      | upstairs front bedroom - office |

| 4      | upstairs middle bedroom - work office|

| 5      | living room - middle port |

| 6      | phalanx             |

| 7      | red-dragon        |

| 8      | red-dragon IPMI|

| 9      | _unused_          |

|10      | _unused_         |

|11     | _unused_          |

|12     | _unused_          |

|13     | _unused_          |

|14     | _unused_          |

|15     | _unused_          |

|16     | _unused_          |

|17     | _unused_          |

|18     | _unused_          |

|18     | _unused_          |

|20     | _unused_          |

|21     | _unused_          |

|22     | _unused_          |

|23     | _unused_          |

|24     | ICX-6610 console interface |

h4. FiberLAN

| *Port* | *Device / Branch* |

| 1      | office (to !MikroTik Switch)|

| 2      | phalanx 10G      |

| 3      | red-dragon 10G |

| 4      | _unused_   |

| 5      | _unused_   |

| 6      | _unused_   |

| 7      | _unused_   |

| 8      | _unused_   |

h3. DHCP Assignments

h4. CopperLAN

| *IP*         | *MAC*             | *Hostname*          | *Description* |

|192.168.3.2   | 08:00:27:69:0b:23 | cauth               | CertAuth (VM) |

|192.168.4.3   | 92:90:14:07:f9:b0 | galaxy-s22          | Samsung Galaxy S22 - phone |

|192.168.4.4   | 10:f0:05:35:01:fb | enthoo-wifi         | enthoo - WIFI |

|192.168.4.5   | 84:55:a5:f7:3a:ec | galaxy-tab-s        | Samsung Galaxy Tab S - old tablet |

|192.168.4.7   | a0:88:69:8c:33:ef | CI320-wifi          | CI320 - WIFI |

|192.168.4.9   | b8:27:eb:ef:eb:a1 | rpi001              | rpi001 - WIFI |

|192.168.4.10  | b8:27:eb:d9:78:8a | rpi-zw-001          | rpi-zw-001 - WIFI |

|192.168.4.11  | d8:3a:dd:78:28:63 | rpi-z2w-001         | rpi-z2w-001 - WIFI |

|192.168.4.12  | f8:59:71:4e:ab:f6 | t470                | t470 - WIFI |

|192.168.4.14  | b8:27:eb:59:18:d2 | rpi002              | rpi002 - WIFI |

|192.168.4.16  | dc:a6:32:19:16:70 | rpi003              | rpi003 - WIFI |

|192.168.4.17  | 70:1f:3c:cd:30:63 | galaxy-tab-a        | Samsung Galaxy Tab A - new tablet |

|192.168.4.18  | 74:d8:3e:b6:be:26 | carbon              | Lenovo Carbon X1 - carbon - WIFI |

|192.168.8.4   | a8:a1:59:44:ca:c4 | enthoo              | enthoo - ETH |

|192.168.8.5   | d0:50:99:c0:38:d6 | red-dragon          | red-dragon ETH |

|192.168.8.6   | d0:50:99:46:c6:74 | phalanx             | phalanx - ETH |

|192.168.8.7   | 00:01:2e:58:d8:81 | CI320               | CI320 - ETH |

|192.168.8.8   | 1c:69:7a:04:08:16 | atto                | atto - ETH |

|192.168.8.9   | b8:27:eb:ba:be:f4 | rpi001-eth          | rpi001 - ETH |

|192.168.8.10  | c8:1f:66:dd:6a:24 | brutus          | brutus - eno1 |

|192.168.8.12  | 54:e1:ad:33:0f:0a | t470-eth            | t470 - ETH |

|192.168.8.13  | d0:50:99:51:76:4c | file2               | file2 - ETH |

|192.168.8.14  | b8:27:eb:0c:4d:87 | rpi002-eth          | rpi002 - ETH |

|192.168.8.16  | dc:a6:32:19:16:6f | rpi003-eth          | rpi003 - ETH |

|192.168.8.50  | a0:ce:c8:03:a1:c9 | --                  | USB adapter |

|192.168.12.1  | 10:ce:a9:0b:e0:fe | cam001              | Reolink Argus Pro |

|192.168.12.2  | ec:71:db:65:c9:4c | cam002              | Reolink RLC-410-5MP |

|192.168.14.1  | 44:61:32:ac:17:cc | ecobee              | Ecobee Thermostat |

|192.168.16.1  | 3c:2a:f4:6b:10:ee | MFC-L3770CDW | Brother MFC-L3770CDW |

|192.168.20.1  | 70:85:c2:da:6c:3d | corsair             | BL Machine |

|192.168.100.0 | 00:1a:1e:16:1a:c0 | aruba-s3500         | Aruba S3500 - UNUSED |

|192.168.100.1 | 58:b6:33:3b:17:e0 | r710                | Ruckus R710 - wireless AP |

|192.168.100.2 | cc:2d:e0:91:42:6e | mikrotik-switch-001 | MikroTik CRS305-1g-4s - 10G switch |

|192.168.100.3 | 18:a6:f7:5f:2b:06 | archerc2600         | TP-Link Archer C2600 |

|192.168.100.4 | 74:8e:f8:dc:b9:b4 | icx6610             | Brocade ICX6610-24P-Switch |

|192.168.208.1 | bc:5f:f4:fe:80:31 | phalanx-ipmi        | phalanx - IPMI ??? |

|192.168.208.3 | d0:50:99:e0:30:de | red-dragon-ipmi     |red-dragon - IPMI |

|192.168.208.4 | 18:66:da:a2:a0:3b | brutus-ipmi     | brutus - IPMI |

h4. FiberLAN

| *IP*         | *MAC*             | *Hostname*          | *Description* |

|10.250.1.2	   | 0c:c4:7a:1f:00:ae | phalanx-10g         | phalanx - 10G |

|10.250.1.3    | 0c:c4:7a:1e:a4:49 | red-dragon-10g      | red-dragon - 10G |

|10.250.1.4    | 24:8a:07:e4:39:91 | enthoo-10g          | enthoo - 10G |

|10.250.1.5	   | 24:8a:07:e3:04:e1 | file2-10g           | file2 - 10G |

|10.250.1.6	   | 24:8a:07:e3:14:81 | brutus-10g           | brutus - 10G |

h2. 10G Supplemental Switch

!{width:30%}crs305_1g_4s.jpg!

"MikroTik CRS305-1G-4S":https://mikrotik.com/product/crs305_1g_4s_in

NOTE: Switch has two operating system options. SWOS is much simpler and therefore preferred for this application.  Note that holding the reset button while powering only resets the RouterOS configuration not the SWOS configuration. To reset SWOS boot into RouterOS and navigate to the terminal, then enter this command:

<pre>

/system swos reset-config

</pre>

Also to set the boot OS: System > Routerboard > Settings > Boot OS

h3. Reset Instructions

* Disconnect all network ports. Disconnect power, using tip of mechanical pencil press reset button and hold. Reconnect power.  When green light flashes several times release the reset button.

* Switch will reboot into RouterOS. 

* To connect connect to MGMT (1G) port to laptop. Set static address on laptop to 192.168.88.2/255.255.255.0 with gateway 192.168.88.1. Open web browser and navigate to 192.168.88.1. 

* Enter basic details, including DHCP setup.

* Click Terminal button in upper right corner. 

** Enter this command to reset SwOS:

<pre>

/system swos reset-config

</pre>

* Next navigate back to Webconfig to change boot configuration: System > Routerboard > Settings > Boot OS and set SwOS. 

* Finally click the Reboot option on the side menu.

* Disconnect from laptop and connect MGMT port back to regular network. After reboot switch should be accessible at DHCP reservation address: 192.168.100.2.

* Default credentials are: admin/<no password>

h3. Configuration

To use 1G port as management port go to RSTP tab and uncheck the checkbox next to MGMT. In Port Isolation tab, isolate MGMT from other ports.

h2. Wireless AP

!{width:50%}R710.jpg!

In August 2021 I replaced the WRT3200ACM with a Ruckus R710 access point.

* https://www.commscope.com/product-type/enterprise-networking/wireless-access-points/indoor/r710/

h3. Wireless Networks

* -57752d54616e67204c414e - legacy 5 GHz - WPA2-

** Decomissioned: June 22, 2024

* 4162726168616d204c696e6b737973 - legacy 2.4 GHz - WPA2

* Weyland-Yutani Corporate - 5 GHz/2.4 GHz - WPA3/WPA2

h2. Backup Switch

* TP-LINK TL-SG1016D - 24 port "dumb" switch

h2. Resources

 * "Fohdeesha Docs":https://fohdeesha.com/docs/index.html

 * "Brocade ICX Series Switches - STH Forum":https://forums.servethehome.com/index.php?threads/brocade-icx-series-cheap-powerful-10gbe-40gbe-switching.21107/