I often read that you should put customer machines into a separate (testing) network like a DMZ.

Is a layer 3 device (switch/router + firewall) a good option for this? Since some ports need to be accessed across the developer and testing network. Is that common practice or is there a better solution?

Some layer 2 communication should be possible for exploring the devices. How can that be achived if networks are splitted on layer 3?

Thank you in advance

  • Please clarify what you have in mind regarding layer 2 communication for "exploring the devices". Aug 14, 2018 at 11:37
  • When using DCP protocol in order to discover devices (e.g. Siemens), layer 2 is needed. en.wikipedia.org/wiki/Discovery_and_Configuration_Protocol
    – nodna
    Aug 16, 2018 at 7:35
  • if you really need to use such protocols than the discovering and discovered devices need to be in the same subnet. I would however encourage you to look carefully at why you would need to have an unmanaged decide discover managed devices, or vice versa. That sounds like a recipe for trouble from a security perspective. I would generally prefer to have all that done by devices I control, and then export the data to whoever needs it. Aug 16, 2018 at 11:38

1 Answer 1


Customer machines are usually considered "unmanaged" by your IT, so you would want them to have access only to a limited set of resources they absolutely need to reach. To do that, you would indeed implement a DMZ, i.e. a network zone for which inbound and outbound traffic are limited to an approved list of flows.

That in turn requires a firewall-like device, though that may not always be enough, from a security perspective. In my environment, we do not provide direct access from an unmanaged device to any platforms, even if the devices are in a DMZ. The DMZ typically allows access to a Citrix farm or jump server of some sort, which then allows the users to do whatever they are supposed to be doing.

I would seriously reconsider any architecture requiring a third-party device to have layer 2 access to anything on your network, or vice versa, because you essentially give up on any control you might have between the two (yes, you could force the traffic through a transparent firewall or IPS, but it's going to be messy).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.