Recommended Posts

That isn't a layer 3 switch that supports that. You would need a layer 4 to block/allow tcp ports like port 80.

True, but Layer 3 switches can do basic ACLs which is all that is really needed in this situation....we need to know the switch that the OP would intend to use for this solution.

True, but Layer 3 switches can do basic ACLs which is all that is really needed in this situation....we need to know the switch that the OP would intend to use for this solution.

You would have to look through but it is a layer 3 he said.

The OP question was vague at best.. Are vlans secure?

As posted already - "secure from what standpoint?"

Are there attacks against vlans - sure, can most of them be mitigated, again sure.. In what context and what risks are you concerned? Without some details of context and from what standpoint we can go round and round for weeks.

Most companies use vlans, and are considered "secure" enough for most business use.

The OP question was vague at best.. Are vlans secure?

As posted already - "secure from what standpoint?"

Are there attacks against vlans - sure, can most of them be mitigated, again sure.. In what context and what risks are you concerned? Without some details of context and from what standpoint we can go round and round for weeks.

Most companies use vlans, and are considered "secure" enough for most business use.

maybe you guys think too deep into the secureness ....

my approach is toward internal staff and guess.

yes i know there are certain attack that are able to penetrate vlans but tat is not what i am looking for.

my question is sort of simple, creating multiple vlans on a single switch(layer 3) that house staff,servers and guess connection.

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

or should them be on seperate switch each with its own vlan.

which approach is better.

The depth of security depends on the need or how the individual perceives security. The requirement is different between securing your house or securing a government facility. By asking questions and entertaining different scenarios shows this.

You are fine if you are protecting your house by using a layer 3 switch to segment the networks. You may want a bit more if you are attempting to secure a government facility or a school (kids like to tinker a lot and really push what you think you know about security).

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

But as you said one of them servers needs to be accessed by staff so if you have them in different VLAN they can?t access it unless you do bridging which is a more setup.

"if you have them in different VLAN they can?t access it unless you do bridging"

What?? You do not need to bridge to access other vlans, you would ROUTE between the vlans would be the normal way. This would normally be done on the switch with intervlan routing, or with each vlan having a connection to your router/firewall that would handle the routing between them.

Now depending on what is doing this routing would determine how granular you could get on your access controls. If what is routing has firewall features then you could prevent access on all kinds of things. You could limit access to IPs based upon port, you could limit on source IP. Depending on the feature set of your firewall you could even do some layer7 filtering if so desired. But no bridging is not a normal way to allow access between vlans.

They are completely different.. Your vlans would normally be on completely different L3 (ip) address space, so bridging traffic would most likely not even work.

Bridging is L2 and routing is L3 - why would you bridge in his setup??

Now if for some odd reason his vlans were using the same IP space, then sure you could bridge the traffic.. BUT would be the point - if he was going to do that, then he might as well just put them on the same vlan.

I never wanted the OP to do bridge I only put that in to keep sc302 happy or we go off on ?server 1 can be on vlan2 and workstations can be on vlan5, vlan2 can access vlan5 and vice versa.? again which fine you can do that with bridging/routing.

All I said was:

Any computer or server needing to access each other needs to be on the same VLAN.

Any computer or server not needing to access each other can be put in a different VLAN.

And pages later we are here I was just trying to make it simple for the OP.

If you are going to drag me into this again....

they do not need to be in the same vlan to have access to each other. You create a rule in the switch to deny access. all vlans, by default in a layer3 switch, have access to eachother if they are routable...how do you make one routable you may ask, give the vlan an IP address. You need to create a rule to deny access from 1 vlan to another, that is it...it is that simple.

and just so we are all on the same page:

maybe you guys think too deep into the secureness ....

my approach is toward internal staff and guess.

yes i know there are certain attack that are able to penetrate vlans but tat is not what i am looking for.

my question is sort of simple, creating multiple vlans on a single switch(layer 3) that house staff,servers and guess connection.

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

or should them be on seperate switch each with its own vlan.

which approach is better.

and incase you don't know wtf a layer 3 switch is,

http://compnetworking.about.com/od/hardwarenetworkgear/f/layer3switches.htm

"A Layer 3 switch is a high-performance device for network routing. Layer 3 switches actually differ very little from routers. A Layer 3 switch can support the same routing protocols as network routers do. Both inspect incoming packets and make dynamic routing decisions based on the source and destination addresses inside. Both types of boxes share a similar appearance."

"Any computer or server needing to access each other needs to be on the same VLAN."

This would only be true if there was no routing available.. What kind of network would it be if there was no routing between segments? I would never in a million years think that showing me a network with multiple segments was not routing between them.

And the OP clearly stated

1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

So clearly he is routing between the vlans..

And the OP clearly stated

1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

So clearly he is routing between the vlans..

No we don't look at what the OP posted here:

https://www.neowin.net/forum/topic/1136988-switch-vlaning-issue/page__st__15__p__595531010#entry595531010

One of the servers is on VLAN 2 with x20 Office PC so clearly no one knows what the OP needs.

I agree, but wtf would you have 4 server nobody gets too. And the guest wireless can go nowhere? Just talk amongst themselves.

The network would be pointless -- again why would you think there is no routing on a network?

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Forza Horizon 6 gets big bug-fixing and balancing update by Taras Buria Today, Playground Games released a big Forza Horizon 6 update with a long list of fixes, patches, and balancing tweaks that the studio promised earlier. Version 375.327 is now available on Steam, Microsoft Store, and Xbox, offering users improvements for AI, audio, design, performance, road discovery, upgrades, visuals, online play, and more. Some of the most notable changes in the Series 2 update include rebalanced drivatars, particularly their difficulty and race start behavior. As such, the game should be more balanced on higher difficulty levels, and AI cars should not shoot out when the race starts as if they have rocket boosters. Speaking of difficulty, developers nerfed Drag Tires physics for a more expected and realistic behavior. They are no longer the go-to option for record-breaking times in road racing, and all leaderboard entries with drag tires will be removed. Completionists will also be glad to get a new feature that lets you see road discovery percentage in each region, which should make discovering all roads easier while keeping it quite challenging and interesting (I spent quite a long time finding the last road). Festival Playlist is also getting some much-needed fixes, including patches for bugs that allowed completing Seasonal Jobs ahead of time or where weekly challenges would not unlock for some players. Developers will retroactively give reward points to all who could not complete all challenges due to these bugs. Other changes include changes to Horizon Play progression so that it is easier to reach Level 100, audio improvements on lower-spec devices, fixes for visual glitches, including pixelated smoke, and more. Developers also addressed the currently non-working Eliminator, an online mode gamers used to farm credits with a Hummer EV exploit. Playground Games plans to re-enable it soon. As a gesture of goodwill, players will get a free McLaren Sabre. Those who used the exploit will not be banned, but developers plan to roll back credits to a maximum of 10M for all who farmed credits using the exploit. You can find the complete changelog for the latest Forza Horizon 6 update here.
    • "Samsung is shutting down yet another app used by millions" I will fix the clickbait title for you, free-of-charge: "Samsung shutting down it's Max VPN app"
    • Microsoft brings Planner Agent to all Microsoft 365 Copilot users by Ivan Jenic Image: Microsoft Microsoft has announced that Planner Agent in Microsoft 365 Copilot is now generally available to all users with a Microsoft 365 Copilot license. Planner Agent is the latest addition in the string of AI features that Microsoft is implementing across virtually all of its products. The agent lets you manage tasks through natural language prompts directly inside Microsoft 365 Copilot. You can create and update tasks, check priorities, and get insights about current entries without leaving the chat interface. The general availability release comes with a handful of new additions on top of what was available during the initial rollout. A new plan picker lets you search and filter your plans by name, then update task names, statuses, due dates, or priorities through the agent. There's also a goals bucket now, which lets you group tasks under specific goals. This builds on the Goals view, a feature that was introduced as part of the broader Planner refresh that rolled out earlier. Image: Microsoft | Planner Agent in Microsoft 365 Copilot All AI-generated plans and tasks are created in draft mode by default, so you can review and approve changes before anything goes through. This is actually a thoughtful safety feature, because trusting AI to handle all your tasks without a human in the loop is usually a recipe for disaster. Having tasks initially saved as drafts is the best possible middle ground. Microsoft also says that not all tasks are executed equally. Simple tasks get processed quickly, while more complex ones, like building a plan from a Word, Excel, or PowerPoint file, are handed to a more capable model. Microsoft says this approach delivers the best performance, but it could also help with usage management, as you won't have to waste tokens on performing simple tasks. Planner Agent is available now across Teams, Loop, SharePoint, and other Microsoft 365 apps for anyone on a Microsoft 365 Copilot subscription.
    • To be clear I'm anti trump, the bigger point is why review this game at all?
  • Recent Achievements

    • First Post
      Cosminus earned a badge
      First Post
    • One Year In
      ThatGuyOnline earned a badge
      One Year In
    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      485
    2. 2
      +Edouard
      189
    3. 3
      PsYcHoKiLLa
      122
    4. 4
      Steven P.
      86
    5. 5
      neufuse
      73
  • Tell a friend

    Love Neowin? Tell a friend!