I have a NAS which is used locally by a computational cluster that I would like to isolate from the corporate network. I have a netgear GS752TXS that connects the various nodes of the cluster as well as a few NAS systems. I have a cable running from the GS752TXS running to a a series of netgear GS716T switches. For the moment, I have defined a VLAN for the NAS systems in the GS752TXS so for the moment the NAS systems are isolated (and pretty much worthless). I would like to allow a few local systems to see the NAS systems (as well as the computational cluster) and would like to stop all traffic from/to the NAS systems from traffic downstream (towards the corporate network side) using VLANs if possible. I am curious if someone with more experience could explain how to set this up if it is possible at all.

There are a couple of ideal case scenarios I can envision, but I am unsure of implementation. The lower the number the more desirable the solution is:

Solution scenarios (what I want not how to do it!)

  1. Allow the NAS systems to see and connect to nodes in the computational cluster as well as to select computers connected to the downstream GS716T switches. Ideally, the downstream computers connected to the GS716T switches should be able to reach the corporate network and the NAS systems, but the NAS systems should not be able to be connectable from the corporate network. The computational cluster must be able to connect to the corporate network to reach license and update servers.

  2. A slightly less desirable solution would be to isolate the NAS systems from the corporate network. The nodes of the computational network must see the NAS systems and connect to the corporate network. Downstream computers connected to the GS716T system should be able see the NAS systems when connected to a particular port on the hub (e.g. I envision ports of a VLAN on the GS716T trunked to the GS752TXS.

Thanks for any help that you can offer.

  • Do you want / intend to set up a router to route between the VLAN with the NAS and the VLAN where any computer that cannot directly reach the NAS resides? (just checking to see if you are thinking of a layer-2 only solution or not) – Slartibartfast Mar 30 '18 at 2:05
  • The ideal solution would be that labeled 1. Basically, the administration wants the NAS systems not to connect to (or be connected from) the outside world, but the computers in our group need to connect to the internet as well as the NAS to access the data on the NAS servers. The computational system also needs access to the NAS systems. I was hoping for a layer 2 VLAN like solution. Normally, I would research the problem and by trial and error find a solution, but time is a little tight in this case. Any suggestions would be welcome. – user2155952 Mar 30 '18 at 2:10
  • Actually, a solution more along the lines of what I called 2. would be a help if implementing a solution like scenario 1 above would be difficult, I would like to restrict traffic from the NAS systems to only travel to/from particular hosts and in particular stop all access in and out from the outside world and the rest of the corporate internet. – user2155952 Mar 30 '18 at 2:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:15

Layer 2 approach:

If your cluster computers support VLANs or have multiple physical ports, give them one port (physical or virtual) on each network, and likewise for the other systems intended to access the NAS.

The challenge here is that all non-NAS systems are now arbiters for access to the NAS network. If one is compromised (any of them), access to the NAS / NAS VLAN is gained.

Layer 3 approach A:

Cluster computers and NAS on the same VLAN, firewall restricts access to cluster computers and NAS with an access list. Depending on performance needs, the other computers with NAS access may be on the NAS VLAN, or allowed with an access list entry.

Layer 3 approach B:

NAS alone in a VLAN, router routes all traffic to the NAS. Firewall restricts access with an access list. This approach is the most protective of the NAS, but it will very likely be a performance hit for access to the NAS (switches are likely to be faster than your router)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.