1

I have the task to integrate 4 PCs (1 server, 3 workers) into a local network (from a bigger organization). The admin of that network only allows me to integrate the server directly into the network (he will give me an IP for my mac address). The 3 workers and the server should therefore communicate within a separate internal network.

What I need to support is the following:

  1. from the organization network, other people should be able to create remote sessions to access Server and Workers.
  2. The workers should (somehow) be able to access the organization network as well (through the Server) to fetch updates from the internet but also access the windows activation server to validate the windows installation every few weeks.

So I am honestly lost at this level of networking. I think so far that the Server needs two network cards so that it can communicate with the internal and the organization network.

I could also imagine that having either a "remote session to server, and from there remote session to worker" solution or maybe a VPN solution into the internal network.

I only have no idea how I can solve the "internet and activation server" problem. The admin of the organization network said to me, that we can regularly plug them into the network, but I dislike the idea to constantly change network setup just to get some activation or updates done.

Any ideas what I can do and how I can do it?

1 Answer 1

1

The 3 workers and the server should therefore communicate within a separate internal network.

That calls for using a separate VLAN.

What I need to support is the following:

  1. from the organization network, other people should be able to create remote sessions to access Server and Workers.

  2. The workers should (somehow) be able to access the organization network as well (through the Server) to fetch updates from the internet but also access the windows activation server to validate the windows installation every few weeks.

You're not mentioning any restrictions. If there are none, you can simply route into and out of your VLAN. Any reasonably sized router or layer-3 switch can do that. However, if there are no restrictions whatsoever, you can just as well put your devices in an existing network.

If you do need restrictions you require a firewall to control the traffic.

Likely, you won't require any additional NICs. To simplify matters, the bigger-organization admin should configure the network as they see fit (possibly just a few switch ports) and let you plug into it. If they can't provide that they need to specify what they demand much more clearly.

Unless you're in a remote location, connected only by Internet, you won't need any VPN.

4
  • That I am allowed to get even one PC into the network is a super exception because normally only "managed" PCs are allowed to join the network. I will look up how I can setup a vlan. Also the "bigger-org" network is big, like we talk about multiple buildings with hundreds of workplaces. Commented Jun 14, 2021 at 20:29
  • The "only-managed-devices" policy is a common and usually reasonable requirement. Likely, they want to isolate your "unmanaged" nodes as completely as possible. That big org should have qualified staff that can set up what they require in a matter of minutes (or maybe hours, depending on the involved teams and changes). Providing Internet access and a small handful of services for an otherwise isolated VLAN is no rocket science.
    – Zac67
    Commented Jun 14, 2021 at 20:53
  • True, but that requires some degree of willing to help which is sadly not really there. We and our needs are kind of politely ignored :D Commented Jun 15, 2021 at 7:53
  • 1
    Well, I'd try a last time, pointing out the difficulties of fulfilling unknown requirements with little expertise and then I'd escalate - but that is OT here. You could also lay out the plan to operate from within a VLAN (that should get proper routing from big org) and ask if that'd be OK. If there's no cooperation you just need a single IP address and use NAT as a last resort.
    – Zac67
    Commented Jun 15, 2021 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.