1

What will be the best solution, to securely separate a network and have internet connectivity.

In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate several users for testing purposes (Server/network testing - Hacking/Security and other tools) and avoid any individuals from damaging our production environment. They are some solutions that came in mind.

network design flow from the room where the testing will be placed.

Room<>Cisco4500<>Cisco6800<>firewall<>asr1000router<>cisco3550<>ISP

1)I will just throw in a switch in the room and have them connect to that only, but that wont work for us.

2)Carve up a vlan on the 4500, separate subnet and add it on the core (Intervlanxxx) apply access-list's - IP helper and let DHCP provide them the ips, but even if we do that it seems that it will still have to go thru some hops, plus DHCP might be vulnerable now ?

3)this might be tricky, just add a cheap 12 port switch, front of that add a linksys router (Static Wan IP) which will provide the users dhcp, nat and provide them private IPs, than carve up a vlan on the 4500 switch and somehow tunnel that back to our switch next to the ISP connection ?? doing so will help eliminate the DHCP vulnerability that might be encountered?

Every scenario i think seems to hit one of our devices, or needs dhcp ?

unless there is a secure way to separate this , maybe you guys have a test environment in the production, the thing is we need internet, which in our end means DHCP-IP Helper is needed. please let me know.enter image description here

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 20:33
1

The general idea is that any traffic originating from this team and destined to the rest of your enterprise network has to pass through the firewall.

Doing it with L2 VLANs like Jeremy Gibbons says is certainly one option.

The other way to isolate this team at L3 is to put them in a separate VRF. You will need to create this VRF on all devices upto and including the Core, and on the firewall you have to arrange things such that the traffic coming from this team is received on an interface which is treated as an "outside" interface for the purpose of firewalling.

The other thing you have to take care of (irrespective of whether you choose to isolate this team at L2 or L3) is to protect your network infrastructure (e.g the 4500) from any bad things that this team may do; e.g. think about what would happen if the tools they use generated an ARP flood.

  • Adding the VRF could be a good idea if all the devices support it. I see it as insurance, in the sense that it makes it harder to accidentally add an IP interface to the untrusted network and thus bridge the two worlds. It's also going to be useful if the untrusted network is more complex than just the single vlan I assumed above. – Jeremy Gibbons Feb 18 '18 at 8:39
2

It's not entirely clear what risks you are trying to cover, but my suggestion would be to create a layer 2 vlan across your set of switches, and propagating it to the firewall. None of the switches should have an IP interface in that vlan, such that the only way out of it is through the firewall. You can then use the firewall to enforce whatever rules you want, allowing or disallowing traffic to the Internet and to or from your other vlans.

DHCP isn't much of an attack vector : your devices only send traffic on their local vlan, and then a relay takes over (if necessary) to talk to the DHCP server.

  • thanks for the insight....i was thinking that maybe the dhcp can be attacked, also was thinking that the vlans are still going thru our network yes im no security expert. – HeC Feb 18 '18 at 3:29
  • Well they're still carried on your infrastructure, so there is still some risk associated with that (DoS of various types for example), but again it really depends what kinds of risks you're seeking to cover. If you're just seeking to segregate a guest team without building all new infrastructure, this should be fine, if you're concerned that team could break things on the network level (say by creating unwanted loops) you'll definitely want to protect yourself more. – Jeremy Gibbons Feb 18 '18 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.