How to separate developpers from productive environment on a network?

[zum]

I'd like to know what possibilities there are to separate application developpers from the productive environment on the same network.

The developpers are spread among different places as other users too. They should have acces to certain services depending on their actual role (develop, test, support etc.).

The ideal solution could be a - more or less - standard access for each user to the backbone of the network. Then either each service checks for the rights of an access to him or there is a central policy server which grants for adequate access rights.

I'm very interrested to read your ideas and experiences.

Thank you very much and kind regards,

Manfred

[r.cheung]

Depending on your environment, Manfred, you may want to create vlans for this segmentation. Vlans enable you to tie similar users together across a campus into one virtual network. You can choose either static vlans, or dynamic vlans. Static would be where connectivity to the vlan would be based on the switchport. Dynamic would be where vlan membership is based on the user's mac address of their nic.

To enable connectivity from the production vlan and the developer's vlan, you would terminate into a layer 3 device. At that point, you can apply your access list to grant/deny services selectively.

[memphis007]

Dear Rick

Thanks for your answer.

One more question.

The users are changing their roles between development, test and production support.

Is it possible for this users to switch between different VLANs then?

Regards

Manfred

[MATT HILL]

You can also use other information, such as info contained in Microsoft Active Directory or Novell NDS to assign users to dynamic VLANs. The Cisco User Registration Tool is the product you would use to do this.

You need DHCP, a "default" VLAN for users to login to, then a VLAN for the users to move to once the URT has determined which VLAN they move to, which in your case would be the development and production VLANs.