One is a "secure" VLAN, the other is a "house" VLAN. At some point, a workflow was developed in which a decision was made that sales staff needed to take some of their materials received from clients and place them directly into some equipment in the "secure" VLAN. A previous IT staffer (I'm not IT staff but I was instructed by the Director of Ops to look into this.) took what I believe he thought was the course of least resistance and added a second NIC to the PC and plugged one NIC into each VLAN. This would seem to make the "secure" VLAN a lot less secure.

How are some of you getting around this issue?


  • 1
    That is what firewalls are for. What you have described would give security and audit staff heartburn. – Ron Maupin Feb 14 '18 at 21:37
  • 1
    Stations attached to a secure VLAN should be treated as secure in any security policy. Having a station attached to both VLANs like this is essentially attaching an insecure station to a secure VLAN. This should be a policy violation and addressed immediately. A different workflow should be developed to transfer "materials" from clients into the secure network resource properly. – YLearn Feb 14 '18 at 22:02
  • @YLearn. I appreciate the response. That's what I was looking for. Workflow suggestions. – Ross Feb 14 '18 at 22:39
  • @RonMaupin. Thank you for your response. I was pretty certain I needed a firewall but I'm not familiar with VLAN to VLAN firewall procedures. I am familiar with trusted and untrusted zones, applications, addresses etc. but only in a capacity of external IP addresses to internal ones. – Ross Feb 14 '18 at 22:42
  • 1
    @Ross, there is no way we can define your workflow. This would depend on a large number of factors we do not have access to; details about the network, details of the data itself, the policies of your workplace/network, etc. Could be as simple as an ACL or it may require a full blown DMZ deployement (with firewall, IDS/IPS capabilities, etc). We simply can't say with the provided information. – YLearn Feb 15 '18 at 0:47

Browse other questions tagged or ask your own question.