Switch VLANing issue.

[sc302 Veteran]

That isn't a layer 3 switch that supports that. You would need a layer 4 to block/allow tcp ports like port 80.

[cawordsworth]

That isn't a layer 3 switch that supports that. You would need a layer 4 to block/allow tcp ports like port 80.

True, but Layer 3 switches can do basic ACLs which is all that is really needed in this situation....we need to know the switch that the OP would intend to use for this solution.

[sc302 Veteran]

True, but Layer 3 switches can do basic ACLs which is all that is really needed in this situation....we need to know the switch that the OP would intend to use for this solution.

You would have to look through but it is a layer 3 he said.

[+PeterUK MVC]

With more expensive switches you don't have to have that server in the vlan.

But your over complicating the setup that the OP might not need.

[+BudMan MVC]

The OP question was vague at best.. Are vlans secure?

As posted already - "secure from what standpoint?"

Are there attacks against vlans - sure, can most of them be mitigated, again sure.. In what context and what risks are you concerned? Without some details of context and from what standpoint we can go round and round for weeks.

Most companies use vlans, and are considered "secure" enough for most business use.

[Jeff Tan]

The OP question was vague at best.. Are vlans secure?

As posted already - "secure from what standpoint?"

Are there attacks against vlans - sure, can most of them be mitigated, again sure.. In what context and what risks are you concerned? Without some details of context and from what standpoint we can go round and round for weeks.

Most companies use vlans, and are considered "secure" enough for most business use.

maybe you guys think too deep into the secureness ....

my approach is toward internal staff and guess.

yes i know there are certain attack that are able to penetrate vlans but tat is not what i am looking for.

my question is sort of simple, creating multiple vlans on a single switch(layer 3) that house staff,servers and guess connection.

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

or should them be on seperate switch each with its own vlan.

which approach is better.

[sc302 Veteran]

The depth of security depends on the need or how the individual perceives security. The requirement is different between securing your house or securing a government facility. By asking questions and entertaining different scenarios shows this.

You are fine if you are protecting your house by using a layer 3 switch to segment the networks. You may want a bit more if you are attempting to secure a government facility or a school (kids like to tinker a lot and really push what you think you know about security).

[+BudMan MVC]

Yes a vlan is a broadcast domain, broadcast traffic will not be seen from the other vlans. This was answered back in post 2.

So we can /thread then.

[+PeterUK MVC]

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

But as you said one of them servers needs to be accessed by staff so if you have them in different VLAN they can?t access it unless you do bridging which is a more setup.

[+BudMan MVC]

"if you have them in different VLAN they can?t access it unless you do bridging"

What?? You do not need to bridge to access other vlans, you would ROUTE between the vlans would be the normal way. This would normally be done on the switch with intervlan routing, or with each vlan having a connection to your router/firewall that would handle the routing between them.

Now depending on what is doing this routing would determine how granular you could get on your access controls. If what is routing has firewall features then you could prevent access on all kinds of things. You could limit access to IPs based upon port, you could limit on source IP. Depending on the feature set of your firewall you could even do some layer7 filtering if so desired. But no bridging is not a normal way to allow access between vlans.

[+PeterUK MVC]

Route or bridge your still crossing over a VLAN if thats what the OP wants do that.

[+BudMan MVC]

They are completely different.. Your vlans would normally be on completely different L3 (ip) address space, so bridging traffic would most likely not even work.

Bridging is L2 and routing is L3 - why would you bridge in his setup??

Now if for some odd reason his vlans were using the same IP space, then sure you could bridge the traffic.. BUT would be the point - if he was going to do that, then he might as well just put them on the same vlan.

[+PeterUK MVC]

I never wanted the OP to do bridge I only put that in to keep sc302 happy or we go off on ?server 1 can be on vlan2 and workstations can be on vlan5, vlan2 can access vlan5 and vice versa.? again which fine you can do that with bridging/routing.

All I said was:

Any computer or server needing to access each other needs to be on the same VLAN.

Any computer or server not needing to access each other can be put in a different VLAN.

And pages later we are here I was just trying to make it simple for the OP.

[sc302 Veteran]

If you are going to drag me into this again....

they do not need to be in the same vlan to have access to each other. You create a rule in the switch to deny access. all vlans, by default in a layer3 switch, have access to eachother if they are routable...how do you make one routable you may ask, give the vlan an IP address. You need to create a rule to deny access from 1 vlan to another, that is it...it is that simple.

and just so we are all on the same page:

maybe you guys think too deep into the secureness ....

my approach is toward internal staff and guess.

yes i know there are certain attack that are able to penetrate vlans but tat is not what i am looking for.

my question is sort of simple, creating multiple vlans on a single switch(layer 3) that house staff,servers and guess connection.

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

or should them be on seperate switch each with its own vlan.

which approach is better.

and incase you don't know wtf a layer 3 switch is,

http://compnetworking.about.com/od/hardwarenetworkgear/f/layer3switches.htm

"A Layer 3 switch is a high-performance device for network routing. Layer 3 switches actually differ very little from routers. A Layer 3 switch can support the same routing protocols as network routers do. Both inspect incoming packets and make dynamic routing decisions based on the source and destination addresses inside. Both types of boxes share a similar appearance."

[+BudMan MVC]

"Any computer or server needing to access each other needs to be on the same VLAN."

This would only be true if there was no routing available.. What kind of network would it be if there was no routing between segments? I would never in a million years think that showing me a network with multiple segments was not routing between them.

And the OP clearly stated

1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

So clearly he is routing between the vlans..

[Original Poster]

ok..i will go into more details,

to give any information I would need to see your running config ? I am not great in setting up networks, but making them as tight as a butt hole is something i am good at

[+PeterUK MVC]

And the OP clearly stated

1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

So clearly he is routing between the vlans..

No we don't look at what the OP posted here:

https://www.neowin.net/forum/topic/1136988-switch-vlaning-issue/page__st__15__p__595531010#entry595531010

One of the servers is on VLAN 2 with x20 Office PC so clearly no one knows what the OP needs.

[+BudMan MVC]

I agree, but wtf would you have 4 server nobody gets too. And the guest wireless can go nowhere? Just talk amongst themselves.

The network would be pointless -- again why would you think there is no routing on a network?