Configuring a network for 100% isolation (for security)

Question

I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several peripherals (a printer, a scanner, etc.), and of course managing the network switch and firewall themselves.

My goal is to configure the switch and firewall to achieve full isolation, for security. Only these flows should be allowed:

1. PCs to Internet, inspected by the firewall
2. PCs to peripherals, through the firewall
3. PCs to network device management (firewall and switch)
4. VoIP phone to Internet, through the firewall

I want to prevent any and all traffic between PCs. And of course prevent from peripherals to PCs.

What is the best way to configure this?

Here's where I'm up to:

VLANs & subnets

• VLAN 2 for PCs
• VLAN 3 for phones
• VLAN 4 for peripherals
• VLAN 5 for network device management

Each VLAN corresponds to a subnet (10.1.2.0/24 for VLAN 2, 10.1.3.0/24 for VLAN 3, etc.)

Switch:

• All PC, phones, and peripheral ports are private VLAN edge / protected ports
• 1 connection to firewall NIC 2 on VLAN 2 *
• 1 connection to firewall NIC 3 on VLAN 3 *
• 1 connection to firewall NIC 4 on VLAN 4 *
• 1 connection to firewall NIC 5 on VLAN 5 *

* I think these ports should be promiscuous trunk ports, but am not sure; please advise

Firewall Interfaces:

1. NIC 1 WAN (Internet) Layer 3 DHCP
2. NIC 2 Layer 3 interface, with subinterface on VLAN 2 with IP 10.1.2.1 ***
3. NIC 3 Layer 3 interface, with subinterface on VLAN 3 with IP 10.1.3.1
4. NIC 4 Layer 3 interface, with subinterface on VLAN 4 with IP 10.1.4.1
5. NIC 5 Layer 3 interface, with subinterface on VLAN 5 with IP 10.1.5.1

*** My understanding is that configuring a VLAN subinterface tells the firewall to only pass it traffic that matches a certain VLAN

All firewall interfaces are configured for routing between them

Firewall rules:

• Allow NIC 2 / VLAN 2 --> NIC 1
• Allow NIC 2 / VLAN 2 --> NIC 4 / VLAN 4
• Allow NIC 2 / VLAN 2 --> NIC 5 / VLAN 5
• Allow NIC 3 / VLAN 3 --> NIC 1

Will this configuration work? Will it block all internal traffic, except the very specifically allowed, on the LAN?

Answer 1

Putting aside the impossibility of 100% security, your plan seems sound. Of course, everything depends on the policies on the firewall. To answer your specific questions, yes, the switch ports to the firewall are promiscuous, and configuring a VLAN on (most) firewalls creates a separate logical interface.

Answer 2

Find the 100% security is basically impossible, however there is something that could help you that is the interface isolation. This means that you use network cards (interfaces) specific for user data, management and others, and you don't mix them. This is not possible all times but prevents issues such as the management of the VLANs as well as complex firewall rules related to vlan that may generate issues.

Answer 3

According to your requirement chosee the devices required Generally a network engineer motive should always be optimised , scalable realiable, secure network design and implementation ...

1. Router(Edge router)
2. Firewall(perimeter firewall)
3. L3 switch(core switch)
4. L2 switch (access switch)

Router

ISP internet link should land the this router , DNS forwarded can be configured in this router

1 ) Default route pointing to ISP gateway should configured on router

2. default route pointing to firewall egress interfàce gateway should configured

Firewall

This firewall is used for NAT and PAT configuration for outbound internet access traffic . And for configuring security policies enabling security features like webfilterring , antivirus, IPS & IDS features .

L3 switch

Switch virtual interfàce (SVI) can be configured on this switch for VLAN and enable inter-Vlan routing and configure access -list accordinglly to restrict traffic among Vlan as per your requirement

L2 switch

This switch is used to connect end devices like laptops , desktops by allocating access-ports and passing required Vlans as per requirement..