I've been reading about this new generation of intelligent switches that provide more user and application control. But I assume they cost more. Have any readers successfully pitched for the increased budget to invest in these switches?

I think the key is to look at your project in two parts. First: What's the price range of the switches you're considering for your upgrade? Second: What IT tasks can you simplify, improve, or speed up as a means to offset any cost difference?

In our recent network security project, we were not looking to upgrade our switches; we had some specific access control problems we had to solve. Our existing NAC solution was having a lot of issues, which in turn was taking up too much of our analysts' time to keep the system running.

When we investigated improvements, we found that we could buy a better access control solution as either an appliance or a switch. Once we saw the level of granularity and visibility that an intelligent switch offered at the access level we decided to accelerate our dorm switch upgrade project, which was originally due to happen the following year. We also purchased several appliances to cover the administration buildings of our campus.

Our budget for the switch upgrade was based on Cisco switches at the access layer; in our case, buying the intelligent switch actually provided a cost savings. More importantly, we identified many ways in which the switch would save us time in operations and support, and those operational savings really make the long-term difference.

In a public university, our primary goals were to keep student machines from spreading malware on the network and to separate traffic among students, faculty, and other staff. We saw many advantages in role-based access control directly in the LAN access switch and we chose ConSentry Networks switches for that purpose.

On the same port that connects our users to the LAN, we now have full control over what each user can do on the LAN. It's all in a single box, which makes deployment easy, and the intelligent switches give us far more info about what's going on throughout our network than we've ever had before.

That detailed understanding of users and applications has helped reduce time spent on tasks like troubleshooting; it is much quicker since we get the username, user role, application, and destination server all tied together. That makes it easy for us to identify the source of a problem - whether it's a user, an application, or a bad policy - and make the needed changes.