0

I am currently planning a lab setup for an academic situation. We have host pc's that students use and we wish them to both have access to the internet and networking kit in the lab.

The university has Standard student images which would be applied to the host machine and from that we can run extra VM's. The VM's will give the students access to the kit via Ethernet. This should allow them to both console in via our terminal server or emulate a VM as a pc within a Topology.

The problem we face both internet connectivity and VM traffic will be using one NIC by deafult. Yes we could use Vlans to stop VM's getting internet access however students could alter the Vlans from the VM's or use clashing Vlans on the kit when emulating a pc in the topology.

MY question to the community is, is there any alternative to allow for a separation of traffic with ONE NIC on the host pc taking into consideration the use of cisco kit both on the university production network and in our labs. (They CAN NOT communication as it could cause clashes.) VM's can not have internet access due to students ability to use that to hack and do generally dubious activities but the host machine/OS NEEDS Internet access.

| improve this question | |
  • I should add Its only preferred that we use one NIC to save expense upgrading pc's I know it would be relatively easy to upgrade the pcs but there's a large number and we would rather stay away from that option if possible – ggjono Feb 26 '16 at 11:46
  • Do the students only have access to the virtual machines themselves, or to the VM host configuration as well? – Jeff Meden Feb 26 '16 at 14:01
1

I would go with VLAN at the OS level.

I suppose the students don't have administrative privilege on the operating system.

If so you can configure 2 virtual adapters in the operating systems, one for the desktop access to the internet and the other connected to the VM.

With proper VLAN filtering the student should not be able to mess up things.

| improve this answer | |
  • But if they wish test vlan settings with switches connected to the host for connection tests this could clash with vlan settings on the pcs. We may also see vlan hopping attacks to get out to the internet if students determine the right vlan id to use. – ggjono Feb 26 '16 at 12:07
  • Q in Q would solve the issue, but I must say I'm unsure if it could be achieved on OS + VM level... – JFL Feb 26 '16 at 12:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.