I’ve been reading about this new generation of intelligent switches that provide more user and application control. But I assume they cost more. Have any readers successfully pitched for the increased budget to invest in these switches?
I think the key is to look at your project in two parts. First: What’s the price range of the switches you’re considering for your upgrade? Second: What IT tasks can you simplify, improve, or speed up as a means to offset any cost difference?
In our recent network security project, we were not looking to upgrade our switches; we had some specific access control problems we had to solve. Our existing NAC solution was having a lot of issues, which in turn was taking up too much of our analysts’ time to keep the system running.
When we investigated improvements, we found that we could buy a better access control solution as either an appliance or a switch. Once we saw the level of granularity and visibility that an intelligent switch offered at the access level we decided to accelerate our dorm switch upgrade project, which was originally due to happen the following year. We also purchased several appliances to cover the administration buildings of our campus.
Our budget for the switch upgrade was based on Cisco switches at the access layer; in our case, buying the intelligent switch actually provided a cost savings. More importantly, we identified many ways in which the switch would save us time in operations and support, and those operational savings really make the long-term difference.
In a public university, our primary goals were to keep student machines from spreading malware on the network and to separate traffic among students, faculty, and other staff. We saw many advantages in role-based access control directly in the LAN access switch and we chose ConSentry Networks switches for that purpose.
On the same port that connects our users to the LAN, we now have full control over what each user can do on the LAN. It’s all in a single box, which makes deployment easy, and the intelligent switches give us far more info about what’s going on throughout our network than we’ve ever had before.
That detailed understanding of users and applications has helped reduce time spent on tasks like troubleshooting; it is much quicker since we get the username, user role, application, and destination server all tied together. That makes it easy for us to identify the source of a problem – whether it’s a user, an application, or a bad policy – and make the needed changes.
Having spent many years in the private sector, I can say that while our university doesn’t necessarily use the full set of intelligent switching features, I see a range of other uses that could help you justify the cost of the solution if it turns out the capital costs are higher for the intelligent switch. Improved auditing and compliance stand out as two important features. With a full record of each user’s activity demonstrating controls for auditors will be quicker. A complete record of who touched which files on which servers over any period of time can easily be provided.
Role-based access control is key for pretty much any company – every organization has sensitive data to protect, whether they’re subject to specific compliance demands or not. Having an easy way to provide that control with no need to change VLANs or ACLs is a huge time savings.
Manufacturing device protection is another area I can see intelligent switches being used, to limit who can reach devices such as robots or gauges on the LAN. Extend that protection to voice over IP phones, printers, card readers and you can quickly see how automating role-based controls to protect devices can save IT a lot of time as well.
Take the time to do a little homework on what an intelligent switch will actually cost you, and incorporate the operational benefits in your calculations to get a better sense of the total cost of ownership. You just might be surprised at how much you save in the long run.
Joseph Vittorelli is director of systems and infrastructure at Fayetteville State University. Past Network Guardians columns.
