Hi I'm trying to sketch a computer network. The network include about 50 computers for employees, 20 computers for tech office, a few network printers, a wifi area and every employee has an ipPhone.

enter image description here

this is the sketch I made, but I'm not sure about few things:

  1. Is it correct to link the ip phones to the pc or should they be connected directly to a switch?

  2. Is the dmz placed in a correct way? It should just keep a decent security level the mail server.

Generally speaking, is it a good configuration for the network or should I change something? I'm not sure this is the right forum where to ask, if not, can you please suggest me where to ask?

  • 1
    1. Depending on the type of IP phone, the phone is connected to the switch and optionally the PC is connected to the phone -- the opposite of how you have it. 2. You've drawn the DMZ in the most generic way possible, so it's difficult to make any comment on it. 3. You have a device labeled "server" at what seems to be the core of your network. Did you mean to have a router there?
    – Ron Trunk
    May 3 '15 at 21:40
  • 2) what should i say more about the dmz? is only the zone where i think it could be good to place the outlook mail server and eventually the host of a website. 3) the server should work as proxy too... bad idea?
    – tony
    May 4 '15 at 6:59
  • 1
    Generally, you should only run the traffic through a proxy that needs to be run through the proxy. If the proxy is out of line, it can often be found in the DMZ. If it is inline it will typically be between the modem and firewall or the firewall and router depending on the environment/needs for the proxy.
    – YLearn
    May 4 '15 at 17:59
  • @tony - Nice drawing. Just a question on your design. Not too sure what the "server" is performing as shown in your design? If it is routing between your subnets/Vlans, I would consider replacing it with a switch that can route packets at wire speed.
    – user4565
    Dec 30 '15 at 19:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11 '17 at 16:22

Yes the IP phones plug into the wall jack and the computers then plug into (daisy chain) the IP phones. This reduces the Ethernet ports count, power and cooling cost, wiring cost, and has virtually zero impact on LAN bandwidth. Your Exchange server goes on the inside network, not the DMZ (see here).

Hope that helps.

  • 2
    The DMZ would be the correct place for a mail filtering server/appliance to prevent direct outside->inside nat translations/access.
    – cpt_fink
    Jun 5 '15 at 2:31
  • @cpt_fink, Ron was pointing out that since Exchange 2007, Microsoft doesn't support putting Exchange servers in the DMZ (both the "Client Access Server" and "Mailbox" server roles are supposed to be internal). Instead, you are supposed to use a "Internet Security and Acceleration" server in the DMZ. You can find this clearly spelled out here and here. Sorry for the late comment, but just saw this when it got bumped.
    – YLearn
    Jan 29 '16 at 4:25
  • Ah, I definitely don't admin Exchange boxes. That was more directed as a good place for any type of separate filtering appliance (IronPort/Barracuda/etc).
    – cpt_fink
    Mar 8 '17 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.