Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

vlan design help

Hi

I have a new switch and am in the process of configuring it. The switch will be used for servers in the DMZ. My issue is should I configure all the vlans in my current environment to be included in this switch, or just those related to those in the dmz.

If it is the later, how would trunking work? how would I be able to forward traffic from other vlans on the trunk if the switch only know about the DMZ vlans?

Thanks for your help

Dan

6 REPLIES
Blue

Re: vlan design help

there should be no need to configure the new DMZ switch with any other VLANs than a single DMZ vlan.

you can setup routing either on that switch if it is L3 or on a router inside the network to the DMZ.

also, if this is a true DMZ, it would be behind a firewall interface. is this the case?

New Member

Re: vlan design help

Hi

Thanks everyone for your replies. I'm kind of new to the networking field, so creating a secure policy isn't my expertise, but I'm trying though.

Currently all the switches, even the old switch with the DMZ servers in it, are connected to each other via fibre links, which create a redundant loop.

From what I can understand from what you have said is that I should not put this new switch in the loop, but have it sit by itself. So if it wanted to access the firewall (pix 515e), which is sitting on another switch I would have to have an ethernet connection between my new switch and the firewall switch, as there aren't any free fibre ports on teh firewall switch. Am I right or is there a better way of designing it?

Thanks in advance

Dan

New Member

Re: vlan design help

You probably don't want to define any more vlan than you need.. then the switch won't to spend the resource to keep track of the spanning tree topology of the extra VLANs.

You might want to keep the VLAN number unique from the rest of the network in case you need to extend the DMZ VLAN to somewhere else in the network .. ..

Re: vlan design help

hi dan,

so now you are not having port to connect the switch with fiber ...and you have to go for the ethernet connection right...now what you want exactly...

regards

Devang

New Member

Re: vlan design help

Hi Dan,

If it is a DMZ switch then you should keep it seperate from the rest of your network. It doesnt really matter what VLANs it can see, but you do not want multiple VLANs configured as access ports on the switch. You also do not want to manage the switch, so do not give it an IP address. Having an IP address on an external switch makes it vulnerable from attack.

HTH,

Dan

Re: vlan design help

hi DAN,

if you are going to add this new switch for DMZ servers and not going to use for the other purpose then you should only configure the switch related to the VLANs of the DMZ...and after all it all depends on your requirement...and you are talking about trunking then with which switch you are going to connect it means connectivity of network and your VLAN requirement is also taking big part in designing

regards

Devang

114
Views
16
Helpful
6
Replies
CreatePlease login to create content