UT as an internal traffic monitor

[jcyphert]

I would like to configure untangle to monitor the traffic inside our domain but between buildings. Each building has about 100 users each and I would like to see a UT box sit transparently between the two locations only monitoring usage but allowing info to flow freely.
Does anyone have any suggestions on doing this smoothly?

Thanks,
jcyphert

[juank]

Sure, no problem. Can you tell us how do you connect buildings?

[jcyphert]

Fiber and VLANs.
Basically if Head Quarters (HQ) is where our WAN is, building1 and building2 are connected to the HQ main switch through a fiber link. That Fiber is converted to a copper line via media converter. So it shouldn't be a problem to plug building1 into ut internal... then ut external into HQ switch.

[juank]

Sure. I wasn't trying to figure out a way to have just one untangle handling all the traffic between all buildings (just one box) but it will probably be too much for it (I say probably, not that is not possible).

You can do what you said, put one untangle in bridge mode in front of each building.

[jcyphert]

OK, next question... How much of a machine would you expect would be required to have ut ONLY doing reporting of 100 people?

[juank]

That's a question I can't answer. It depends... it depends of your IP traffic behavior... you can have a network of 100 people doing their job and have no problem.
You can have another network with 2 people, both running P2P apps all the time and they can take that network/untangle down to its knees really easily... so ... it depends.

[proactivens]

How much reporting are you going to be doing? Are you going to monitor all traffic or just web type traffic? If you are going to monitor all traffic, then you would load up the web filter and the protocol control, that way you could get reports on sites as well as services. Attack blocker may be of use to help identify machines on the network that are either sending or recieving too much traffic, or machines that may be infected with spyware or viruses. For 200 users using one box, I would definately go with a quad core system with 4 gigs of ram and a decent sized hard disk (over 100gb).

[juank]

Agree.

[jcyphert]

For now, the most important thing we want to see is the overall web traffic. What Open Source package is doing the web traffic reporting?

[cheaman]

I realize this thread is about using Untangle to monitor the traffic, but I do similar with using ntop (ntop.org). We have 33 sites that come back to our CO. We mirror the switch ports to our box running ntop and it gives us an entire breakdown of all traffic. There is also a virtual appliance available if your interested.