Nutter helps a reader protect the servers in his growing network.
As our network grows in size, so does the need to protect the servers. We have already put in an interior firewall between the servers and the users to help control some of the problems we started to see. Although we have started using DHCP reservations to control some of the IP address assignments to a few of the workstations for those situations in which we needed to further control access to a specific host, it becomes an administrative headache as users move around, needs change, etc. Is there another way to handle this?
Via the Internet
An option to consider is the use of virtual LANs (VLAN). Assuming you have managed switches (those that have some type of interface that allows you to configure the internal workings of a switch vs. one you can only take out of the box and plug in), this can help make what you are trying to do a little easier. With a VLAN you group selected workstations into a specific subnet regardless of where they may be on the network. This helps simplify your firewall rules settings for allowing host access by letting you enter subnet ranges instead of individual IP addresses.
When getting into VLANs, you will see two types of switches, Layer 2 and Layer 3. Layer 3 switches are the more configurable and thus more expensive. Layer 2 switches can participate in VLANs but won’t have as much functionality. The core, or main, switch in your network will have to be Layer 3. This will save you from spending as much money on the edge switches (e.g., the switches that the end users’ PCs connect to for network access) unless you need Layer 3 functionality for some other reason.
Depending on the vendor you choose for your VLAN, there is one thing you need to watch. You’ll need one device (possible more, again depending on the vendor) that will hold the master VLAN database information. Before you put a new switch on the network, configure so it’s a client – not a server – in the VLAN configuration. You run the risk of damaging or erasing your network’s VLAN configuration by adding a second VLAN server, depending on the type of voting mechanism the vendor uses to track who has the VLAN information for the network.
I also suggest documenting each port on the switch via configuration so you know what port goes to what port on the patch panel. I would suggest putting in some type of jack number instead of a person’s name so when people changes occur, you minimize the amount of changes you have to make in your documentation. Also, back up the switch configuration and keep it in a safe place. This way, if a switch fails or has to be replaced, you minimize the downtime when configuring the new switch.
