What will be the best solution, to securely separate a network and have internet connectivity.
In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate several users for testing purposes (Server/network testing - Hacking/Security and other tools) and avoid any individuals from damaging our production environment. They are some solutions that came in mind.
network design flow from the room where the testing will be placed.
Room<>Cisco4500<>Cisco6800<>firewall<>asr1000router<>cisco3550<>ISP
1)I will just throw in a switch in the room and have them connect to that only, but that wont work for us.
2)Carve up a vlan on the 4500, separate subnet and add it on the core (Intervlanxxx) apply access-list's - IP helper and let DHCP provide them the ips, but even if we do that it seems that it will still have to go thru some hops, plus DHCP might be vulnerable now ?
3)this might be tricky, just add a cheap 12 port switch, front of that add a linksys router (Static Wan IP) which will provide the users dhcp, nat and provide them private IPs, than carve up a vlan on the 4500 switch and somehow tunnel that back to our switch next to the ISP connection ?? doing so will help eliminate the DHCP vulnerability that might be encountered?
Every scenario i think seems to hit one of our devices, or needs dhcp ?
unless there is a secure way to separate this , maybe you guys have a test environment in the production, the thing is we need internet, which in our end means DHCP-IP Helper is needed. please let me know.