Recommended Posts

That isn't a layer 3 switch that supports that. You would need a layer 4 to block/allow tcp ports like port 80.

True, but Layer 3 switches can do basic ACLs which is all that is really needed in this situation....we need to know the switch that the OP would intend to use for this solution.

True, but Layer 3 switches can do basic ACLs which is all that is really needed in this situation....we need to know the switch that the OP would intend to use for this solution.

You would have to look through but it is a layer 3 he said.

The OP question was vague at best.. Are vlans secure?

As posted already - "secure from what standpoint?"

Are there attacks against vlans - sure, can most of them be mitigated, again sure.. In what context and what risks are you concerned? Without some details of context and from what standpoint we can go round and round for weeks.

Most companies use vlans, and are considered "secure" enough for most business use.

The OP question was vague at best.. Are vlans secure?

As posted already - "secure from what standpoint?"

Are there attacks against vlans - sure, can most of them be mitigated, again sure.. In what context and what risks are you concerned? Without some details of context and from what standpoint we can go round and round for weeks.

Most companies use vlans, and are considered "secure" enough for most business use.

maybe you guys think too deep into the secureness ....

my approach is toward internal staff and guess.

yes i know there are certain attack that are able to penetrate vlans but tat is not what i am looking for.

my question is sort of simple, creating multiple vlans on a single switch(layer 3) that house staff,servers and guess connection.

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

or should them be on seperate switch each with its own vlan.

which approach is better.

The depth of security depends on the need or how the individual perceives security. The requirement is different between securing your house or securing a government facility. By asking questions and entertaining different scenarios shows this.

You are fine if you are protecting your house by using a layer 3 switch to segment the networks. You may want a bit more if you are attempting to secure a government facility or a school (kids like to tinker a lot and really push what you think you know about security).

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

But as you said one of them servers needs to be accessed by staff so if you have them in different VLAN they can?t access it unless you do bridging which is a more setup.

"if you have them in different VLAN they can?t access it unless you do bridging"

What?? You do not need to bridge to access other vlans, you would ROUTE between the vlans would be the normal way. This would normally be done on the switch with intervlan routing, or with each vlan having a connection to your router/firewall that would handle the routing between them.

Now depending on what is doing this routing would determine how granular you could get on your access controls. If what is routing has firewall features then you could prevent access on all kinds of things. You could limit access to IPs based upon port, you could limit on source IP. Depending on the feature set of your firewall you could even do some layer7 filtering if so desired. But no bridging is not a normal way to allow access between vlans.

They are completely different.. Your vlans would normally be on completely different L3 (ip) address space, so bridging traffic would most likely not even work.

Bridging is L2 and routing is L3 - why would you bridge in his setup??

Now if for some odd reason his vlans were using the same IP space, then sure you could bridge the traffic.. BUT would be the point - if he was going to do that, then he might as well just put them on the same vlan.

I never wanted the OP to do bridge I only put that in to keep sc302 happy or we go off on ?server 1 can be on vlan2 and workstations can be on vlan5, vlan2 can access vlan5 and vice versa.? again which fine you can do that with bridging/routing.

All I said was:

Any computer or server needing to access each other needs to be on the same VLAN.

Any computer or server not needing to access each other can be put in a different VLAN.

And pages later we are here I was just trying to make it simple for the OP.

If you are going to drag me into this again....

they do not need to be in the same vlan to have access to each other. You create a rule in the switch to deny access. all vlans, by default in a layer3 switch, have access to eachother if they are routable...how do you make one routable you may ask, give the vlan an IP address. You need to create a rule to deny access from 1 vlan to another, that is it...it is that simple.

and just so we are all on the same page:

maybe you guys think too deep into the secureness ....

my approach is toward internal staff and guess.

yes i know there are certain attack that are able to penetrate vlans but tat is not what i am looking for.

my question is sort of simple, creating multiple vlans on a single switch(layer 3) that house staff,servers and guess connection.

what i want to achieve is that, servers are in 1 vlan and staff in 1 vlan and guess in 1 vlan

sort of some isolation where broadcasting will not be seen in either of them.

or should them be on seperate switch each with its own vlan.

which approach is better.

and incase you don't know wtf a layer 3 switch is,

http://compnetworking.about.com/od/hardwarenetworkgear/f/layer3switches.htm

"A Layer 3 switch is a high-performance device for network routing. Layer 3 switches actually differ very little from routers. A Layer 3 switch can support the same routing protocols as network routers do. Both inspect incoming packets and make dynamic routing decisions based on the source and destination addresses inside. Both types of boxes share a similar appearance."

"Any computer or server needing to access each other needs to be on the same VLAN."

This would only be true if there was no routing available.. What kind of network would it be if there was no routing between segments? I would never in a million years think that showing me a network with multiple segments was not routing between them.

And the OP clearly stated

1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

So clearly he is routing between the vlans..

And the OP clearly stated

1 of them is a file server which store office files...

the 20 office computer has are able to read/write to a certain directory (eg . Office Doc) in D: drive

So clearly he is routing between the vlans..

No we don't look at what the OP posted here:

https://www.neowin.net/forum/topic/1136988-switch-vlaning-issue/page__st__15__p__595531010#entry595531010

One of the servers is on VLAN 2 with x20 Office PC so clearly no one knows what the OP needs.

I agree, but wtf would you have 4 server nobody gets too. And the guest wireless can go nowhere? Just talk amongst themselves.

The network would be pointless -- again why would you think there is no routing on a network?

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • EA launches in-game advertising platform for brands to "connect with audiences" by Pulasthi Ariyasinghe The gaming giant Electronic Arts is exploring more ways to inject real-life brands into its games. Announced today as EA Advertising, the new platform is attempting to make it easier for brands to reach out for deals with the company and put their products inside titles like EA Sports FC, Madden, NHL, Skate, or The Sims. EA revealed that its EA Sports side of the company brings in "hundreds of millions of players across console, PC, and mobile" every year. Fan engagement of these titles was also touted as being "extraordinary," with 23,000 NFL seasons worth of games being played in Madden NFL daily, while EA Sports FC sees over a billion matches a day. “Players come to EA’s games and live experiences every day to play, watch, create and connect,” said David Tinson, Chief Experiences Officer at Electronic Arts. “That gives brands a meaningful opportunity to show up in ways that add value and respect the player experience, while maintaining authenticity in the worlds our teams are building. With EA Advertising, we’re helping brands become part of those moments in ways that are relevant and built for players.” Using the new program EA Advertising, brands will be able to inject their products into games in real-time via dynamic placement. EA says partners will have access to everything from stadium signage in sports games and targeted adverts to in-game content custom-made for the brands. These are described as additions designed to "enhance, not disrupt" experiences. "In these interactive gameplay environments, brands become part of the game itself, reflecting how players engage with advertising in real-world contexts," adds the company "Brands can activate across live environments, tailoring placements to meet campaign objectives, and update campaigns with ongoing optimization informed by aggregated engagement insights." Current real-world brand partnerships EA has built into its games include Visa (EA Sports FC and College Football), Lowe's (EA Sports FC, Madden NFL, and College Football), Red Bull (EA SPORTS FC), Xfinity and Peacock (EA SPORTS FC), and Mountain Dew’s (College Football).
    • Will be surprised if there isn't a new ver of youtube just for labelled educational content
    • UK to ban under-16s from social media following a six-week trial with teenagers by Paul Hill Credit: Pexels A few months ago, Neowin reported that the UK was trialing a social media ban with 300 teenagers for six weeks, that testing has come to an end, and Prime Minister Keir Starmer has announced that the country will ban under-16s from social media. Starmer said that this technology is making children unhappy and making it easier for bullies to harass and abuse them. He continued to talk about the addictive nature of social media, saying that it uses an infinite scroll designed to lock users in for hours. He said this interferes with children doing their homework, reading, playing with friends outside, and going to bed on time. Tackling the idea that nothing can be done about social media, Starmer said: The government’s action won’t stop at social media either, the PM said. It plans to take action on gaming services and livestreaming platforms. Right now, he said, strangers can contact any child unchecked. He said this wouldn’t happen in real life, and the government is going to stop it from happening online, too. The Labour government has overseen the introduction of the Online Safety Act, a big change to the internet which includes age verification on adult websites. This has led to a fair bit of backlash, but overall, the government is pushing ahead with these changes.
    • Still using Hexchat every day but i would not consider it Retro 😛
    • HONOR Robot Phone unveils first Cinematic Video at Shanghai International Film Festival by Steven Parker Global AI device ecosystem company HONOR announced on June 13 that its revolutionary HONOR Robot Phone made its professional imaging debut at the 28th Shanghai International Film Festival (SIFF), demonstrating the result of its mobile videography capabilities for the first time. As the official mobile photography and videography partner of the 28th Shanghai International Film Festival, HONOR empowers this premier cinematic event with cutting-edge mobile imaging technology. Marking the global debut of the first cinematic video it captured, Robot Phone breaks down the boundaries between mobile imaging and professional filmmaking, ushering in a new paradigm for the deep integration of technology and cinematic art. In the video published on HONOR’s official channel (above), Robot Phone was used byELLEMEN to capture cinematic video portraits for the SIFF jury members. With its exceptional stability and cinema-grade imaging capabilities, the device redefines the art of portrait filmmaking, faithfully reproducing the rich tonal gradations and nuanced color transitions associated with film photography. The result is a new level of visual sophistication, creating high-end cinematic imagery that seamlessly blends atmosphere with narrative tension. The video released for the Robot Phone showcases the powerful stabilization capabilities of its built-in gimbal system, delivering exceptionally smooth handheld camera movement while preserving full image quality. By minimizing reliance on electronic image stabilization, the device effectively avoids the image cropping and quality loss typically associated with digital stabilization methods. Representing an innovative leap in form factor, the HONOR Robot Phone features the industry's smallest titanium alloy gimbal, delivering ultra-precision, extreme flexibility, and superior stability. Driven by high-performance motors, the gimbal rises dynamically, breaking free from the physical limitations of traditional camera modules. Combined with advanced AI algorithms that enable intelligent object tracking and various movements with stable shots, the device significantly simplifies video creation and reshapes both the equipment choices and creative habits of modern users. Notably, the Robot Phone will be the first product that features the results of HONOR's strategic technological partnership with ARRI, the world-renowned designer and manufacturer of professional camera technology for cinematic storytelling. From Cannes to Shanghai, the HONOR Robot Phone continues to lead the mobile imaging industry into an entirely new stage of development. Moving forward, HONOR will leverage cutting-edge AI and mobile imaging technologies to unlock new creative possibilities and extend cinematic standards for visual expression from the world of high-end filmmaking to the next generation of content creators. Learn more about the HONOR Robot Phone here: https://www.honor.com/global/events/honor-robot-phone/
  • Recent Achievements

    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      511
    2. 2
      +Edouard
      200
    3. 3
      PsYcHoKiLLa
      137
    4. 4
      ATLien_0
      89
    5. 5
      Steven P.
      84
  • Tell a friend

    Love Neowin? Tell a friend!