I have an upcoming project in which I need to create and divide our company production , database, web, etc. servers into different vlan and how certain users (regular user, admins) with rights is able to have access to certain servers. Currently all the servers are on the same subnet /20 and users are on a different subnet /24. What would be the best way to approach this considering we have 100 servers and 200 users? Please state the pros and cons of each approach. Any suggestion is appreciated. Thanks in advance!
3
-
Why the layer-2 (VLAN) separation?– Ron Maupin ♦Commented Sep 29, 2015 at 18:37
-
I don't understand going to all this trouble. Unless there is a broadcast problem, dividing into VLANs doesn't really gain much.– Ron Maupin ♦Commented Sep 29, 2015 at 19:04
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.– Ron Maupin ♦Commented Jan 5, 2021 at 23:08
Add a comment
|
3 Answers
100 servers and 200 users - there are a lot of ways to segregate that. But since you have clearly said that you want to divide by function (prod, db, web, etc) I'd suggest the following:
SERVERS: Take the 100 servers that are currently on the /20. Divide them up by function. For each function, add in 'room-for-growth'. This is probably the hard part. But better to plan at this stage. Then start subnetting.
Depending on your requirement, it may or may not make sense to have a consistent mask throughout. Say one subnet needs only 4 ips, and another needs 200, it doesnt make sense to keep a /24 throughout. But if the numbers are more or less the same, then use the same mask. Consistency will pay off when you are trying to automate things later.
USERS: Then take the user network, and segment it similar to what you did for the servers. These are both independent of each other, I assume. You will have IP ACLs on a higher protocol layer , to control access.
-
I like this approach but one question i do have is, would it be better to leave all the user in the same vlan and just use IP ACLs to allow only for admins?– Tan LeCommented Sep 29, 2015 at 20:03
-
1At just 200 users, its okay to leave them in 1 vlan, and use ACLs for admins. But if you have a feeling that the users are gonna grow ( hint: they always do ) then you want to subnet them further. Think of it this way - each time a user needs to connect to a server he will arp out for the gateway if the arp isnt in his cache. This is a broadcast both at Layer2 and Layer3. So all the other users on the same VLAN are subjected to that broadcast. Dividing them into smaller VLANS will take away some of that broadcast. Thats just one of the many benefits you get from subdividing further Commented Sep 29, 2015 at 20:16
-
Since we are a financial institution in which our auditor REQUIRES us to segment different servers functions into different vlan for security purposes, are there other ways to tackle this issue? I am presenting this to our CTO and any suggestion with pros/cons is what he wants to know before we proceed. Thanks by the way you been alot of help.– Tan LeCommented Sep 29, 2015 at 20:29
-
Understood. I work for a financial enterprise too. And it makes sense to segment VLANs by function - hence my first response to actually go that route. Another option is to keep separate switches - atleast 2 sets. One is for market data, which by nature is very spiky, but not heavy on bandwidth. For this you have to pick a switch with deep buffers, and low latency. The second set would be for file i/o, and db VLANs which are heavy on bandwidth, but not spiky. This way , database operations dont affect other prod market data. Within each set, you would separate VLANs by function as stated. Commented Sep 29, 2015 at 20:37
-
@TanLe, separating servers by function, but VLANs don't really offer any security since you seill still need to let the users get to the servers. That is a function of server security. VLANs would help you easier block all the users from the servers, but that defeats the purpose of the server. VLANs have nothing to do with user access on the servers. It is a lot of work for very little gain.– Ron Maupin ♦Commented Sep 29, 2015 at 21:46
You can create access-list, that can be applied on the interfaces in outgoing direction, matching some traffic with the IP that you need.
Also you can work with iptables on your server,. but, on the other hand, why you want to use vlans??
-
The reason for diving the servers into separate vlan is because we are a financial institution in which our auditor REQUIRES us to segment different servers functions for security purposes. what other ways are there to divide the servers?– Tan LeCommented Sep 29, 2015 at 20:11
-
Do you have a routing device or firewall? Then you can apply policies on the forwarding between vlans!! Commented Sep 29, 2015 at 20:39
I would create VLANs (w/ SVIs) for each group that needs to be separated. That is the easy part. As far as permissions, you can do it the easy way via AD or the hard way would be access lists based on users IP addresses that are assigned to them. You can use reservations in DHCP, but at the scale you are talking this would never work efficiently. There are some good security tools (Cisco ISE) that can look into the type of traffic and allow or block based on users/systems, etc.
