2

Our company going to move in a new office, for this I'm trying to re-design the internal network (LAN).

TARGET : try to achieve a more reliable and secure network than what we have now.

ACTUALLY : in a couple of months the number of collaborators improved from 3 to 11, and of course, also the numbers of devices connected to the LAN. I don't think the actual & very basic design is anymore adapt to our situation:

There is the ISP router+firewall connected to the switch, and all the end users connected to the switch via ethernet. Plus there is a shared printer, a NAS for sharing files and a server for testing code.

Number Of connected devices (more in detail) :

  • 12 labtops (wired)
  • 9 smartphones (wifi)
  • 3 ipad (wifi)
  • 2 access points (wired to the router)
  • 1 shared printer (wired).

Following 2 devices, as user3799089 suggested, I plan to put them in the DMZ portion behind firewall:

  • 1 webserver
  • 1 NAS

I'm not an expert, but i've never seen a network design with that many devices connected to just a switch, and i'm thinking to add a new Layer of switches, and devide the network in the following way.

enter image description here

In addition, I would directly connect the test server to the router, and give the possibility to reach it from the outside world using NAT(we don't have a static ip actually). I would protect the server and the NAS behind a firewall(in attition to the one integrated in the router).

Actually our bandwidth is 40/4 Mbit/s , but I still doesn't know how much of it we do use. In the first 2 weeks in the new office, the ISP will monitor our bandwidth usage, and tell us if 40/4 is enough for us.

MY QUESTIONS :

  • Adding a new layer of switches does improve in any way the reliability of the network?
  • Setting up a double firewall to reach the server and the NAS make it more secure? is usually the firewall integrated in the router reliable?
  • NATTING a dynamic address to make it reachable from the outside, is a bad practice for any security reason?
Improve this question
3
  • A little more info would be nice on the number of devices & how heavy the network usage is. 1) adding a new layer of switches doesnt really improve reliability. Stackable switches will add redundancy for any vlan Default gateway. also known as first hop redundancy. 2) double firewall is generally not a good idea. Depends on the firewall capabilities if you can just use a DMZ design for the server/nas & not have 2 devices doing NAT. makes throubleshooting difficult. 3) NAT is how 99% of all internal lans reach the outside public internet. look into a dmz for your server
    – LucentMoon
    Aug 3, 2014 at 4:56
  • Thankyou for the comment, I updated the question with the details i can actually provide (about 29 devices connected, and a 40/4 Mbit/s bandwidth, but i still doesn't know how much of it we use)
    – user7783
    Aug 3, 2014 at 13:29
  • 1) the redundancy provided by a new layer of switches, at my noob eyes, is not really primary/fundamental actually. 2) Are you saying that having 2 device doing NAT makes it hard to troubleshoot in case is necessary? Having a DMZ area would require just 1 NATTING? 3) ok I m already looking for better understand the DMZ logic
    – user7783
    Aug 3, 2014 at 13:35

1 Answer 1

Reset to default
1

First of all put Your firewall betwen Your ISP and edge router !

You have so few host that You are able to bind all host using at least two switches (which wouldn`t be so expansive) connected to each other so when one fall down second one will continue passing frames to the router.

You can use also static DHCP leases to assign the same IP address to specified hosts in Your network. No matter where they connect their device they will receive that same IP address all the time.

Good security practice is to give Your AP`s different range of IP addresses and exclude them from Your wired part of LAN network. You can also add a VPN tunels to Your NAS and server aspeccialy while using WiFi.

Improve this answer
4
  • Great, thankyou for the Answer. 1) I udpdated the second picture of the question, I putted the firewall between ISP and edge router. Its just a way to represent the firewall integrated inside the router, did I understand you right? 2)Does it happen frequently that a switch fall? Never happened to me in 1 year. 3) can you please explain me how can improve security to DHCP in a static way? I see it usefull just for check who of us did something, am I wrong?
    – user7783
    Aug 3, 2014 at 13:52
  • 4) If I give certain range of IP to an access point (half devices to one AP), and the other half devices to the other AP, and I use static DHCP, then half devices will be able to connect to just one AP right? Thank you again for the helpfull Answer
    – user7783
    Aug 3, 2014 at 13:53
  • What he means is, on the DHCP server you can bind the device MAC address to an IP address from the dhcp range. That way, if you do decide to implement multiple switches/WAPs, the clients will always get the same IP address no matter how often they move around the network. Not always good if you have multiple vlans though. Your updated design looks good. just make sure that switch 0 is the Spanning-tree Root bridge & has backup links or Etherchannel to the access layer switches
    – LucentMoon
    Aug 4, 2014 at 4:23
  • Oh I almost forget - hide SSID broadcast at Yours AP`s ;D
    – DDos Schwagins
    Aug 4, 2014 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.