0

We have a cabinet of dedicated servers with a Brocade FESX648-PREM switch at the top. We own all the hardware and all the MAC addresses are known to us. We also fully manage the servers so we retain administrative access, but our customers have administrative access as well.

Currently we use VLANs and subnets to isolate the servers, prevent IP hijacking, etc. However, we want to make more efficient use of our IPv4 allocations. We lose a lot of usable IPs for gateway purposes and we have an abundance of subnets too small for many customer needs.

I've considered progressively migrating the servers to a single VLAN and use static ARP to prevent IP hijacking. We'd lose layer 2 isolation, but I'm not sure what sort of abuse that would open us up to.

What are the dangers of placing all of our servers on a single VLAN with only static ARP bindings to prevent IP hijacking? In other words, what forms of abuse would be possible with a single VLAN config that would not be possible with every server on its own VLAN? Are there any precautions we can take to prevent the abuse while achieving our goals of more efficient IPv4 usage?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 12, 2017 at 5:16

2 Answers 2

Reset to default
1

Are the addresses used in your network public?

If no - wasting up private address space is not an issue, but using VLANs to split customer logically gives a lot of benefits: if limiting broadcasts and such a traffic flow related aspects is not a problem, then, from a point of security, mixing everything together will end up badly. And using static ARP bindings - I would not call it as a real security solution, just like a MAC filtering at wireless.
Using VLANs will allow you to manage this better by using logically correct ACL`s or firewall rules to keep the customers isolated and that will scale good enough and will not become "who the hell had this IP?" in 10.10.0.0/16 subnet.

If IPs are public - wasting them is an issue. Strict firewall rules on the servers could help, but in fact network diagram would be useful to have an idea where some security measures could be applied as there's still the issue with mixing everyone up in one bucket.

Improve this answer
2
  • Thank you for your input -- upvoted. To answer your questions, the IPs are public and we have a rather simple hub-and-spoke network design. We have a few cabinets all with top of cabinet switches that are all edge devices. The edge switches connect to a single core router. That core router has cross-connects to a couple transit providers as well as an IXP. Can you think of any specific examples of attacks or abuses that would be possible in a single VLAN config but would not be possible in a multiple/isolated VLAN config? Thanks!
    – Elliot B.
    Aug 26, 2015 at 19:29
  • ARP spoofing comes into my mind as one issue. A few question tho. How are the customers connecting to the servers? Do they simply connect from everywhere to specific public IP and ISP routes them to you? Can everyone from the public web see these servers and services on them? Is there some kind of a security device in-between or how are servers protected overall at the moment? What access does the customer have? Some kind of a web-app only or much more than that with access to CLI, etc.?
    – Vieplis
    Aug 27, 2015 at 18:37
-1

One Vlan with static IP sound ok but aren't 2 are better option? 1 untagged vlan for traffic and 1 vlan with static IP for managment.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.