One is a "secure" VLAN, the other is a "house" VLAN. At some point, a workflow was developed in which a decision was made that sales staff needed to take some of their materials received from clients and place them directly into some equipment in the "secure" VLAN. A previous IT staffer (I'm not IT staff but I was instructed by the Director of Ops to look into this.) took what I believe he thought was the course of least resistance and added a second NIC to the PC and plugged one NIC into each VLAN. This would seem to make the "secure" VLAN a lot less secure.

How are some of you getting around this issue?


closed as too broad by Ron Maupin Apr 1 '18 at 20:41

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    That is what firewalls are for. What you have described would give security and audit staff heartburn. – Ron Maupin Feb 14 '18 at 21:37
  • 1
    Stations attached to a secure VLAN should be treated as secure in any security policy. Having a station attached to both VLANs like this is essentially attaching an insecure station to a secure VLAN. This should be a policy violation and addressed immediately. A different workflow should be developed to transfer "materials" from clients into the secure network resource properly. – YLearn Feb 14 '18 at 22:02
  • @YLearn. I appreciate the response. That's what I was looking for. Workflow suggestions. – Ross Feb 14 '18 at 22:39
  • @RonMaupin. Thank you for your response. I was pretty certain I needed a firewall but I'm not familiar with VLAN to VLAN firewall procedures. I am familiar with trusted and untrusted zones, applications, addresses etc. but only in a capacity of external IP addresses to internal ones. – Ross Feb 14 '18 at 22:42
  • 1
    @Ross, there is no way we can define your workflow. This would depend on a large number of factors we do not have access to; details about the network, details of the data itself, the policies of your workplace/network, etc. Could be as simple as an ACL or it may require a full blown DMZ deployement (with firewall, IDS/IPS capabilities, etc). We simply can't say with the provided information. – YLearn Feb 15 '18 at 0:47

Browse other questions tagged or ask your own question.