| Version | Status | date | Author:in |
|---|---|---|---|
| 0.1 | First draft | 20.12.2023 | Felix Köppel |
| 0.2 | Revision | 09.01.2024-11.01.2024 | Felix Köppel |
| 0.3 | Addition after measurements | 12.01.2024 & 15.01.2024 | Felix Köppel |
| 0.4 | Additions | 17.01.2024 & 18.01.2024 | Felix Köppel |
| 0.5 | Small additions | 24.01.2024 & 25.01.2024 | Felix Köppel |
| 0.6 | Additions to firewall, switch and devices | 02.02.2024 | Felix Köppel |
| 0.7 | Additions and channel allocation | 06.02.2024 | Felix Köppel, Fabio Pagotto |
| 0.8 | Further additions and planning update, setting up network PVID8 | 07.03.2024 & 14.03.2024 | Felix Köppel |
| 0.81 | Status update for internet subscription | 02.05.2024 | Felix Köppel |
| 1.0 | Last finalisations and final version | PENDING | Egil Rüefli, Felix Köppel, Fabio Pagotto |
This network concept was created by the project team of Rafisa Informatik GmbH.
Hardturmstrasse 134
8005 Zurich
| Your name | Position | e-mail address | Phone number |
|---|---|---|---|
| Andreas Engweiler | Managing Director | andreas.engweiler@kraftwerk1.ch | 044 446 40 66 |
| Alex Hafner | Administration & Management | alex.hafner@kraftwerk1.ch | 044 446 40 64 |
| David Müller | Client representative (Müller Schnörringer Architects sia) | dm@muellerschnoerringer.ch | 044 545 10 66 |
| Andreas Knecht | CEO Electrical installation company (Züri Elektro AG) | andreas.knecht@zueri-elektro.ch | 044 209 92 90 |
Hardturmstrasse 269
8005 Zurich
Bernstrasse 88
8953 Dietikon
| Your name | Position | Phone number | |
|---|---|---|---|
| Fabio Pagotto | Responsible for Firewall and LAN | f.pagotto@rafisa.ch | +41 76 306 71 51 |
| Felix Köppel | Responsible for LAN, Firewall and WiFi | f.koeppel@rafisa.ch | +41 78 713 43 65 |
| Egil Rüefli | Project Manager | e.rueefli@rafisa.ch | +41 78 767 84 04 |
This concept specifies the VLAN IDs, VLAN names and IP addresses including the subnet mask, the DHCP lease time and the functions of the VLANs. The access authorisations of the VLANs are also specified.
This concept contains the VLAN information and DHCP configurations. Please note that VLAN 10 cannot be used, as this VLAN may be required for the Swisscom Internet connection. VLAN 9 is reserved for the fallback Internet connection. It should also be noted that this VLAN is only designed as a „virtual cable“ from the server room to the top floor and is also optional.
| PVID | VLAN name | IP subnet | Subnet mask | Lease | Hosts (Range) | Function |
|---|---|---|---|---|---|---|
| 1 | VLAN01_MGMT | 10.1.1.0 | 255.255.255.0 | 30 days | 154 (.100 - .254) | Management VLAN → Management of all devices |
| 2 | VLAN02_IOT-WR | 10.1.2.0 | 255.255.255.128 | 30 Days | 30 (.30 - .60) | Network only for inverters and automatic mailbox |
| 3 | VLAN03_IOT-MOB | 10.1.3.0 | 255.255.255.0 | 1 Day | 250 (.3 - .253) | For mobility (Tesla etc.), e-mobile charging station |
| 4 | VLAN04_IOT | 10.1.4.0 | 255.255.255.0 | 30 days | 250 (.3 - .253) | All IoT devices |
| 5 | VLAN05_GAST | 10.1.5.0 | 255.255.255.0 | 1 Hour | 250 (.3 - .253) | For guests. Has content filter (parental control and more) |
| 6 | VLAN06_Jugend | 10.1.6.0 | 255.255.255.0 | 1 Hour | 250 (.3 - .253) | For all minors. Has content filter (parental control) |
| 7 | VLAN07_ERW | 10.1.7.0 | 255.255.255.0 | 1 Hour | 250 (.3 - .253) | For adults |
| 8 | VLAN08_FAIRCUS | 10.1.8.0 | 255.255.255.0 | 1 Day | 250 (.3 - .253) | Fair Customer Network |
| 9 | VLAN09_FALLBACK | - | - | - | - | Virtual cable from top floor to firewall for LTE/5G fallback |
Parental control filter includes NSFW filters and other things that young people are not allowed to access.
The additional filter in the guest network only makes mail, social media (youtube, instagram, Facebook and co.), web browsing, video platforms (Netflix and co.) available.
| VLAN | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | WAN |
|---|---|---|---|---|---|---|---|---|---|---|
| 01_MGMT | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✘ | ✔ |
| 02_IOT-WR | ✘ | ✔ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ |
| 03_IOT-MOB | ✘ | ✘ | ✔ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ |
| 04_IOT | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ |
| 05_GAST | ✘ | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ | ✘ | ✘ | ✔ |
| 06_JUGEND | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ | ✘ | ✔ |
| 07_ERW | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ | ✔ |
| 08_FAIRCUS | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ | ✘ | ✔ |
| 09_FALLBACK | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✔ | ✘ |
The two network diagrams are intended to illustrate our concept. The logical plan shows how the devices communicate with each other. The Layer3 plan shows the structure of the proposed VLANs.
Will be added after Internet Package upgrade
Will be added after internet package upgrade
| Quantity | device | Device manufacturer | Model | Note |
|---|---|---|---|---|
| 1 | Modem | Supplied by Init7 | ||
| 1 | Firewall | Hunsn | RS41 | |
| 1 | Controller | Ubiquiti Networks | Cloud Key Gen2 Plus | |
| 1 | Switch | Ubiquiti Networks | USW-24-PoE | |
| 1 | Switch | Ubiquiti Networks | USW-Flex | Attic |
| 1 | PoE Injector | Ubiquiti Networks | U-POE-AT | for switch top floor |
| 2 | Access Point | Ubiquiti Networks | U6-Pro | Top floor / slipper bar, for ultra high density |
| 4 | access point | Ubiquiti Networks | U6-Plus | all remaining rooms, for low/medium density |
| 2 | access point | Ubiquiti Networks | UAP-AC-Lite | Garage (WiFi 5 Only for better device compatibility) |
| 1 | Access Point | Ubnt (ubiquiti networks) | UAP | Legacy device for server room only - reuse from before rebuild |
| 1 | PoE Passive Injector | Ubnt (ubiquiti networks) | 24 passive poe | Legacy device for server room only - reuse from before conversion |
In order to have a better overview of all devices, a table was created with the devices, including IP address allocation and VLAN access.
| Device name | Host name | PVID | PVID Tagged | IP address | Connection type | Location | Notes |
|---|---|---|---|---|---|---|---|
| U6-Pro | ap-kw1-dg | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.13 | LAN | Attic floor | |
| U6-Pro | ap-kw1-pb | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.12 | LAN | Slipper bar | |
| U6-Plus | ap-kw1-kr | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.11 | LAN | Creative room | |
| U6-Plus | ap-kw1-jr | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.10 | LAN | Youth room | |
| U6-Plus | ap-kw1-kd | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.9 | LAN | Consumer depot | |
| U6-Plus | ap-kw1-gz | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.8 | LAN | Guest room | |
| UAP-AC-Lite | ap-kw1-gn | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.7 | LAN | Garage (North) | (WiFi 5 Only) |
| UAP-AC-Lite | ap-kw1-gs | 1 | 3, 4, 5, 6, 7, 8 | 10.1.1.6 | LAN | Garage (South) | (WiFi 5 Only) |
| UAP | ap-kw1-edv | 1 | 7 | 10.1.1.5 | LAN (24passive) | IT room | LEGACY device |
| USW-Flex | sw-kw1-02 | 1, 2, 3, 4, 5, 6, 7, 8, 9 | 10.1.1.4 | LAN TRUNK | Top floor | ||
| USW-24-PoE | sw-kw1-01 | 1, 2, 3, 4, 5, 6, 7, 8, 9 | 10.1.1.3 | LAN TRUNK | RK-KW1-01 | ||
| Cloud Key Gen2 | uck-kw1-01 | 1 | 10.1.1.2 | LAN | RK-KW1-01 | ||
| devices Fair Customer | 8 | DHCP | LAN & WiFi | Office () | |||
| devices adults | 7 | DHCP | WiFi | ||||
| devices youth | 6 | DHCP | WiFi | ||||
| devices guests | 5 | DHCP | WiFi | ||||
| IoT end devices | 4 | DHCP | WiFi | ||||
| TV attic | 4 | DHCP | LAN | Top floor | |||
| Mobility devices | 3 | DHCP | WiFi | Garage |
The following table contains all the device types used with the possible connection options and those recommended by us (or determined in meetings).
| Quantity | Brand name | Device name | Device type | IT functionality | Proposal Connection | Location |
|---|---|---|---|---|---|---|
| Inverter | Ethernet/WiFi | Ethernet | ||||
| E-mobile | WiFi | WiFi | Garage |
| Device name/brand | Device type | Connection type | PVID | IP address assignment | Hostname |
|---|---|---|---|---|---|
| Inverter | LAN | 2 | DHCP | - | |
| E-Mobile | LTE/WiFi | 3 | DHCP | - |
Changes possible, not final yet!
Switch Model: USW-24-POE Ubiquiti Networks Switch 24 PoE Standard
PoE budget: 95 watts. Used in total: 75 watts.
| Port | patch | PVID (native/[tagged]/{profile}) | Device | MAC address | Power | Hostname / Note |
|---|---|---|---|---|---|---|
| 1 | - | 1 | Management laptop | Management only | ||
| 2 | - | FREE | ||||
| 3 | UG04 | |||||
| 4 | EC07 | |||||
| 5 | EC05 | |||||
| 6 | EC06 | |||||
| 7 | EC04 | |||||
| 8 | UG02 | |||||
| 9 | - | 1 - UCK | Cloud Key Gen2 Plus | 70:a7:41:f9:65:63 | 13 Watt | uck-kw1-01 (RK-KW1-01) |
| 10 | UG03 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | UAP-AC-Lite | d8:b3:70:b6:a7:b8 | 6.5 Watt | ap-kw1-gs / Garage South (WiFi 5 Only) |
| 11 | UG01 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | UAP-AC-Lite | d8:b3:70:b6:a8:16 | 6.5 Watt | ap-kw1-gn / Garage North (WiFi 5 Only) |
| 12 | EG01 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | U6-Plus | d8:b3:70:e9:34:3c | 9 watts | ap-kw1-gz / guest room |
| 13 | EC12 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | U6-Plus | d8:b3:70:e6:d9:40 | 9 Watt | ap-kw1-kd / consumer depot |
| 14 | EG11 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | U6-Plus | d8:b3:70:e9:06:68 | 9 watts | ap-kw1-jr / Youth room |
| 15 | EG02 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | U6-Plus | d8:b3:70:e9:4d:60 | 9 watts | ap-kw1-kr / creative room |
| 16 | EG03 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | U6-Pro | e4:38:83:6b:47:31 | 13 Watt | ap-kw1-pb / slipper bar |
| 17 | - | 1 [7, 8] - AP-EDV | UAP | 24:a4:3c:86:6c:e4 | - | ap-kw1-edv / EDP-AP. 24v Passive PoE Injector |
| 18 | EG09 | - | FAIR CUSTOMER | |||
| 19 | EG08 | - | PACKAGE STATION | |||
| 20 | EG10 | - | FAIR CUSTOMER | |||
| 21 | DG01 | - | RESERVE ATTIC | |||
| 22 | DG02 | TRUNK {UPLINK} | USW-Flex Port 1 | ac:8b:a9:a5:ed:0e | - | PoE+ Injector powered, Uplink SW-KW1-02 |
| 23 | - | TRUNK {UPLINK} | Firewall LAN2 | - | Reserved - Link aggregation Firewall! - Disabled | |
| 24 | - | TRUNK {UPLINK} | Firewall LAN1 | - | Main uplink to the firewall |
| Port | PVID (untagged/[tagged]/{profile}) | Device | MAC address | Power requirement | Device name/note |
|---|---|---|---|---|---|
| 1 | TRUNK | Switch server room | d8:b3:70:5c:fd:77 | Power Input | PoE+ Injector |
| 2 | 7 | indeterminate | - | unknown | |
| 3 | 7 | Mains connection cabinet | - | Connection in the cabinet | |
| 4 | 7 | Mains connection table | - | Connection table | |
| 5 | 1 [3, 4, 5, 6, 7, 8] {AP-Uplink} | U6-Pro | e4:38:83:72:96:71 | 13 watts | ap-kw1-dg |
You could set the TRUNK profile on port 4 and connect a USW-Flex Mini, which only consumes 2.5 watts, and configure it according to the requirements in order to have more Ethernet connections.
Felix has written down the WiFi SSIDs (WiFi network names), the encryption type, the VLAN allocation and the radio frequency bands here. Felix has also written down the bandwidth limitation for the network. The information is given from the client's point of view, i.e. 20/30 (up/dn) would be 20Mbit/s upload and 30Mbit/s download.
Shared Key is a new technology with which you have one SSID and several passwords. Depending on the password you enter, you can access one VLAN or the other. You can store several passwords and specify which VLAN they will be sent to.
| SSID | PVID | Frequency band | Encryption | AP group | Devices | QoS (Mbit/s) | Other |
|---|---|---|---|---|---|---|---|
| KW1-DEBUG | 1 | 2.4GHz & 5GHz | WPA3-SAE | All | Admins & test devices | unlimited | only active during debugging |
| KW1-Mobility | 3 | 2.4GHz & 5GHz | WPA2-PSK | GARAGE | Cars, end devices Mobility | 40/40 (up/dn) | Active |
| KW1 | 1, 4, 5, 6, 7, 8 | 2.4GHz & 5GHz | WPA2-PSK | All | All devices | 50/50 (up/dn) | Active with shared key |
| KW1-EDV | 7 | 2.4GHz | WPA2-PSK | EDV | Admins in the IT room | unlimited | Only active on AP in the EDV room! |
| 2.4GHz frequency band | 5GHz frequency band | |||||||
|---|---|---|---|---|---|---|---|---|
| AP host name | AP-Group | Channel | Bandwidth | TX power | Channel | Bandwidth | TX-Power | More |
| ap-kw1-edv | EDV | Auto | 20MHz | 23dBm | - | - | - | 2.4GHz only |
| ap-kw1-gn | GARAGE, GN | 9 | 20MHz | 20dBm | 48 | 80MHz | 20dBm | WiFi 5 only |
| ap-kw1-gs | GARAGE, GS | 5 | 20MHz | 20dBm | 64 | 80MHz | 20dBm | WiFi 5 only |
| ap-kw1-kd | KD, All | 13 | 20MHz | 17dBm | 64 | 40MHz | 23dBm | |
| ap-kw1-gz | GZ, All | 1 | 20MHz | 17dBm | 136 | 40MHz | 23dBm | |
| ap-kw1-jr | JR, All | 5 | 20MHz | 26dbm | 136 | 40MHz | 26dBm | Relief KR |
| ap-kw1-kr | KR, All | 1 | 20MHz | 26dBm | 52 | 80MHz | 26dBm | PB relief |
| ap-kw1-pb | PB, All | 5 | 20MHz | 22dBm | 128 | 80MHz | 26dBm | Outdoor Mode |
| ap-kw1-dg | DG, All | 5 | 20MHz | 22dBm | 128 | 80MHz | 26dBm | Outdoor Mode |
Will be added later!
In realisation phase.
Upgrade to init7 fibre 1/1 gbit/s with media converter and TV subscription - confirmed! Order is not yet finalised.
Currently: Swisscom Fibre connection 40/40 mbit/s with Swisscom Internet Box Standard
Mobile provider/subscription: Unknown 4G/5G modem: To be added!
To be completed!
To be added!
Existing Blue TV with sports subscription