ECE Sysadmin Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Tier 1, 2 and 3 ECE research networks ======

=== Large, complex network ===

ECE provides wired computer network access throughout departmental office space. This is a large and complex network with dual homing on the UofT backbone, routers, gateways, firewalls, traffic monitoring, and nearly 40 switches, serving over 3000 jacks in 48 grad rooms and over 300 offices and labs in Bahen, GB, SF, Pratt, Engineering Annex (and a few locations elsewhere). We operate four climate-controlled server rooms, including one for user-managed servers and clusters.

=== Diverse, flexible networking options ===

Our network design accommodates our professors' requests for a range of flexible connectivity options. Some professors have opted to manage their own networking including IP address space, DNS, and optionally self-managed firewall and/or DHCP ('tier 3'); others have asked our department staff to manage all these aspects of their networking ('tier 1' and 'tier 2'). 

=== Private nets ===

A few professors have entered into industry partnerships whose terms require special network configuration to ensure compliance with non-disclosure agreements ('private networks'). PCs on a private net have very restricted network access, only through a staff-administered (tier 1) gateway PC.

=== Network segregated by tier ===

As well, computers linked to staff-administered networks may be assigned either to be user-managed, or administered exclusively by our department support staff. We use VLANS - virtual LANs - to manage connectivity between computers on the same support tier. For better security, we isolate staff-administered computers and networks from user-managed ones: 
  * Tier 1 connects staff-administered Windows and Linux desktops and servers, and staff-administered printers; 
  * Tier 2 connects all user-administered PCs, Macs, laptops, printers and servers that rely on staff-administered network firewall, DNS and DHCP IPs;
  * Tier 3 provides unmanaged access to UofT's backbone for specific professors, with all aspects user-administered (IP space, DNS, firewalling)

=== User login accounts ===

ECE staff also administer Linux and Solaris servers for research use. ECE research users on any network tier may be assigned a login account by their supervisor on any network tier on these (tier 1) managed systems for research computing. A login account provides email, networked storage with archival backups, and allows running Linux or Solaris software applications such as Cadence, Verilog, etc.  on Tier 1 linux hosts, and compiling user source code. Each assigned user login is charged back to the user's supervisor each month while the account remains open.

=== Charge-back cost recovery ===

ECE provides full-time support staff for research computing (as of fall 2016, six full-time staff). Part of the cost of these services, and some pooled costs for network software licenses, are recovered through charge-backs to each ECE research professor based on: the number of PCs on staff-managed networks (tier 1 & 2); number user login accounts on staff-managed servers; and for users without either of these assigned, a modest minimum charge per supervised research group member (grads, postdocs, RAs, techs and visitors/casuals). Each professor is assessed one 'tier 3/wireless only user' fee for each supervisee who is not assigned a billable Tier 1/Tier 2 PC or user login account. (We sometimes refer to this for brevity as a 'tier 3 fee', though it is applicable to any supervisee whether their supervisor does or does not operate a //tier 3 network//.)

==== What Tier will I be on? ====

== If your supervisor has a Tier 3 network ==

Your supervisor decides what network tier your computer will connect on. If your supervisor has a Tier 3 network, he or she will likely assign you a tier 3 network connection, and will tell you what IP address and gateway/mask settings to use. (ECEHELP cannot tell you what Tier 3 IP to use - ask your supervisor.) 

== Other ECE professors without Tier 3 networks ==
Otherwise, your supervisor may opt to assign you either Tier 1 or Tier 2 network connection. Staff-administered Debian linux workstations are assigned to Tier 1, permitting NFS access to your network home directory and installed linux applications. Staff-administered Windows 7 workstations are assigned to Tier 1. 
  * On Tier 1, our staff handles all setup and software installation/configuration. 
  * User-managed PCs assigned to Tier 2 may run your choice of O/S; you become responsible for all setup, installation, configuration and troubleshooting.

Some professors use a mix of Tier 1 and 2 networks for their group, so discuss with your supervisor if you have a preference for your assigned PC.

== Laptops ==
Laptops (owned by ECE or personally) are always user-administered, since you need to be able to manage them when not on campus, so a laptop can only be on Tier 2 or Tier 3 for wired access. 

== Apple Mac computers ==
Mac OS systems have not been incorporated as staff-administered, so we also assign Mac computers to either Tier 2 or Tier 3. 

===== Network Do's and Don'ts =====

Given the size and complexity of ECE's computer networks, we ask your cooperation in keeping our networks manageable and working smoothly. 
Before connecting any computer to the network in any ECE office, grad room or lab, or relocating a computer from one network jack to another:

==== Do's ====
  * **Please DO** contact ecehelp at ece.utoronto.ca to include us before adding or moving any PC assigned to Tier 1 or Tier 2;
     * For network jacks that you know for certain are on your group's tier 3 network, we don't need to be involved - add, remove, relocate away, with your supervisor's okay
  * **Please DO** configure all Tier 1 and Tier 2 PCs to use DHCP / 'Obtain an IP address automatically' + 'Obtain DNS server address automatically'
  * **Please DO** ensure your PC is set to use Network time to set the system clock; UofT's network time server is **chime.utoronto.ca**
  * to find out what VLAN and tier a specific network jack is assigned, and to request a jack be assigned to a particular T1/2/3 network:
     * **DO** let us know the room number and the full info on the jack label, such as BA4000 jack# 4N-4000-D31
     * many common rooms have jack numbers that do not match 1 for 1 with desk numbers; for networking please tell us the **jack** number
     * For Tier 1 and 2, **DO** let us know the MAC address of any PC to be removed, relocated, or added to the network,
     * and who is to be the assigned user of any PC that is being added or moved
     * For moves, **DO** tell us the old room and jack # as well as the new room and jack #

==== Don'ts ====
Users on any network tier, please...
  * **Please do not** install wireless access points on campus; only UofT's central administration may do so
  * **Please do not** run peer-to-peer networking such as BitTorrent; see UofT's network terms of use [link]

Users on Tier 1 and Tier 2 networks, please...
  * **Please do not** plug in any unregistered device to any jack on a Tier 1 or Tier 2 network - the jack may be locked out and require us to reset it
  * **Please do not** transfer an IP address from one computer to another; if you get a new PC, or get a new ethernet card/NIC or replaced motherboard, please contact ECEHELP to update our DHCP and inventory, and the network security settings, to allow the new or updated hardware access
  * Many PCs today include two or more ethernet ports; **please pick one**, register and stick with that one; take care you do not mix up which one is registered with ECE as each has a different MAC address (the same applies to using a USB ethernet vs. built-in, and to many docking ports)
  * **Please do not** assign an IP address manually, or guess IP addresses until you find one that 'works' - there are hundreds of users sharing the Tier 1 and 2 networks, and our staff has the only full inventory of assigned IPs and (sometimes very few) unused ones for a given network
  * **Please do not** install any networking device (NAT, router) or enable network services such as DHCP, DNS, routing, NAT, wireless bridging...
  * **Please do not** create 'bridged' connections from a registered computer to other unregistered devices
  * **Please do not** 'share' your network connection or printer connection