Help Design My Office Network

[KarmaPoliceSTL]

Hey all, so i've been tabbed with setting up a small office network... i'll be the first to admit i'm not super savy on the networking side of things, more of a server/vmware/db guy by training... but i'm eager to learn, and there's not many others here that can help me...

Anyway, wanted your feedback on the following idea...

Requirements:
- Host web applications for up to 300 users
- Host internal applications for up to 100 users
- Have VPN capabilities to the internal applications (i'm preferring SSL VPN i think) with up to 50 concurrent connections
- FIPS level encryption of anything web -> dmz and the vpn
- Intrusion Detection, AV, AntiSpam, Filtering
- ~3 application servers in DMZ (moderately virtualized) (expanding to 2-3x over 5 years)
- ~5 application servers internally (moderately virtualized) (expanding to 2-3x over 5 years)
- Expandable NAS array on internal
- Backup for DMZ & internal servers
- WiFi access at our office to internal network

What I'm thinking (let me know if i'm even in the right class for this stuff):

Web-DMZ Firewall - Juniper SSG5
DMZ-Internal Firewall - Juniper SSG5
SSL VPN - Juniper SA4500 FIPS
Edge Router - Juniper SRX100 (w/ AV, IDPS, AS, WF)
DMZ Switch - Cisco SG300-20 (already owned)
Internal Switch - Juniper EX4200 48T (maybe 2x)
WiFi - TBD... this is where i'm really clueless, but need it to be very secure.

Things I'm curious about...

anyone know of a cheaper FIPS compliant SSL VPN? 12k is a little more than i want to pay... especially since the non-FIPS version is only 4k...

Going to go do some browsing on here now about office WiFi, but any help there would be greatly appreciated, have a ~3000sqft office, with a central reception/elevator area, but otherwise open floor basically. Also, what are some of the better WiFi security options.

Do i need the Web-DMZ firewall? or will the SRX100 do basically the job of both?

what am i missing? (should i get an NTP device? others?)

 

[MikeTrike]

Take a look at UniFi if you need easy to deploy WAP's. Also take a look at QNAP if you need a good NAS device that won't "break the budget."

Also make sure your network does not look like this:

 

[/usr/home]

I believe Cisco ASAs are FIPS compliant. They'll do the SSL VPN nicely as well as the DMZ. Maybe a 5510?

 

[KarmaPoliceSTL]

Take a look at UniFi if you need easy to deploy WAP's. Also take a look at QNAP if you need a good NAS device that won't "break the budget."

Also make sure your network does not look like this:

So noted... cable management is a habit of mine on PC/home-network builds, so i'm sure i'll be just as anal retentive with the office build out

 

[KarmaPoliceSTL]

I believe Cisco ASAs are FIPS compliant. They'll do the SSL VPN nicely as well as the DMZ. Maybe a 5510?

The little network admin i've done has all been on juniper... what's the learning curve/shock like of switching to cisco... i'm going to have to learn this SG300-20 but i figure a switch is significantly easier than some of the stuff i'll have to do with routing/firewalls/vpn/etc...

 

[/usr/home]

ASDM makes it a lot better. CLI is best for routers/switches, but for the ASA ASDM helps a lot. I'm not going to lie that its a bit difficult but not too bad once you figure it out. I just finished getting mine setup with multiple public IPs, SSL VPN, LDAP authentication, etc. I've never used Juniper so I can't comment on a comparison.

 

[ben chi(f4)]

Could captive portal be an option for guest wifi?

 

[MikeTrike]

Could captive portal be an option for guest wifi?

I should note that the UniFi AP's also do captive portal for guest SSID.