I have an upcoming project in which I need to create and divide our company production , database,and dev servers into different vlan and how certain users (regular user, admins) with rights is able to have access to certain servers. I have create a simple diagram below to propose how i am going to do this. My question is should i put separate the dev and dev db server or should I combine them together as one vlan? Please let me know the pros and cons for each route. Any suggestion will help! Thanks
there is no such problem in follow the normal network hierarchy (routing traffic is 80% of the allover traffic and the switching traffic is 20%), so you will create separate VLAN for all servers which will be your server farm , and depend on the specification divide each user group (access same resources , share same functionality ) in separate VLANs
The point here of segregating devices into VLANs is so that you can apply your security rules to each VLAN. So the answer to your question is create as many VLANs as you have different policies. For example, if dev apps and dev db are always accessed by the same group of people, there's not much point in having them in separate VLANs.
Be careful that your rules make sense and follow your business practices. Otherwise you end up with every device in its own VLAN, and you'll spend all your time managing access lists.