Separate a network within the enterprise environment

Question

What will be the best solution, to securely separate a network and have internet connectivity.

In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate several users for testing purposes (Server/network testing - Hacking/Security and other tools) and avoid any individuals from damaging our production environment. They are some solutions that came in mind.

network design flow from the room where the testing will be placed.

Room<>Cisco4500<>Cisco6800<>firewall<>asr1000router<>cisco3550<>ISP

1)I will just throw in a switch in the room and have them connect to that only, but that wont work for us.

2)Carve up a vlan on the 4500, separate subnet and add it on the core (Intervlanxxx) apply access-list's - IP helper and let DHCP provide them the ips, but even if we do that it seems that it will still have to go thru some hops, plus DHCP might be vulnerable now ?

3)this might be tricky, just add a cheap 12 port switch, front of that add a linksys router (Static Wan IP) which will provide the users dhcp, nat and provide them private IPs, than carve up a vlan on the 4500 switch and somehow tunnel that back to our switch next to the ISP connection ?? doing so will help eliminate the DHCP vulnerability that might be encountered?

Every scenario i think seems to hit one of our devices, or needs dhcp ?

unless there is a secure way to separate this , maybe you guys have a test environment in the production, the thing is we need internet, which in our end means DHCP-IP Helper is needed. please let me know.

Answer 1

The general idea is that any traffic originating from this team and destined to the rest of your enterprise network has to pass through the firewall.

Doing it with L2 VLANs like Jeremy Gibbons says is certainly one option.

The other way to isolate this team at L3 is to put them in a separate VRF. You will need to create this VRF on all devices upto and including the Core, and on the firewall you have to arrange things such that the traffic coming from this team is received on an interface which is treated as an "outside" interface for the purpose of firewalling.

The other thing you have to take care of (irrespective of whether you choose to isolate this team at L2 or L3) is to protect your network infrastructure (e.g the 4500) from any bad things that this team may do; e.g. think about what would happen if the tools they use generated an ARP flood.

Answer 2

It's not entirely clear what risks you are trying to cover, but my suggestion would be to create a layer 2 vlan across your set of switches, and propagating it to the firewall. None of the switches should have an IP interface in that vlan, such that the only way out of it is through the firewall. You can then use the firewall to enforce whatever rules you want, allowing or disallowing traffic to the Internet and to or from your other vlans.

DHCP isn't much of an attack vector : your devices only send traffic on their local vlan, and then a relay takes over (if necessary) to talk to the DHCP server.