Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I often read that you should put customer machines into a separate (testing) network like a DMZ.
Is a layer 3 device (switch/router + firewall) a good option for this? Since some ports need to be accessed across the developer and testing network. Is that common practice or is there a better solution?
Some layer 2 communication should be possible for exploring the devices. How can that be achived if networks are splitted on layer 3?
Thank you in advance
Customer machines are usually considered "unmanaged" by your IT, so you would want them to have access only to a limited set of resources they absolutely need to reach. To do that, you would indeed implement a DMZ, i.e. a network zone for which inbound and outbound traffic are limited to an approved list of flows.
That in turn requires a firewall-like device, though that may not always be enough, from a security perspective. In my environment, we do not provide direct access from an unmanaged device to any platforms, even if the devices are in a DMZ. The DMZ typically allows access to a Citrix farm or jump server of some sort, which then allows the users to do whatever they are supposed to be doing.
I would seriously reconsider any architecture requiring a third-party device to have layer 2 access to anything on your network, or vice versa, because you essentially give up on any control you might have between the two (yes, you could force the traffic through a transparent firewall or IPS, but it's going to be messy).
