Re: [fw-wiz] need opinion of security experts on network design


1-each floor is a separate VLAN

If you can guarantee that each floor will stay a separate collision
domain, then I would use separate LANs, i.e. Layer 2 switches for
the floors.

2-all switches in the floors are layer 3 switches (no layer 2 switches at all)

Why? Nothing in your architecture requires this.

3-no VLAN spans multiple swtiches,

Especially because of 1 and 3.

4-each of the floors' switches are connected via point-to-point
interconnecting VLAN to a core switch

Now, for the core switch I would use a pair of layer 3 switches, statically
assign a VLAN for each floor to an _access_ port on each of them,
and connect each floor switch via two uplink ports to each of the core

The core switches can do the routing statically, since you only
ever configure layer 3 information on two devices. They can
provide redundancy to the access/distribution layer (floor switches
and hosts) via HSRP (in a Cisco world) or some similar means for
layer 3 and spanning tree for the layer 2 connections.

5-No spanning tree at all in the network as each switch is a different
unique VLAN

No spanning tree => no redundancy on layer 2 unless I missed something.

6-All VLANs routing are done via OSPF protocol
so i have about 50 VLANs with about 50 interconecting VLANs

can any one gives me his opinion from security point of view on that design?

Security = C * 1 / Complexity

Your design looks overly complex for the architecture requirements
sketched in 1 - 4.

Kind regards,

Patrick M. Hausen
Leiter Netzwerke und Sicherheit
-- GmbH * Kaiserallee 13a * 76133 Karlsruhe
Tel. 0721 9109 0 * Fax 0721 9109 100
Gf: Jürgen Egeling AG Mannheim 108285
firewall-wizards mailing list

Relevant Pages

  • FW: Best VLAN supporting Switch
    ... you must install a router which interconnects each VLAN. ... Layer 3 switches tends to be very costly. ... The switches are about $1200 and the layer 3 module is $1400. ... node network with 200+ cisco switch's using multiple vlan's. ...
  • Re: Re (2): Linux hub
    ... "Switches may operate at one or more OSI layers, including physical, ... as such basically ignored everything above layer 1. ... would not be complex enough to call a CPU in modern times. ... cause of this is saturation of the bus between the network card and the CPU, ...
  • Re: How to tell if my vlans are layer 2 or layer 3.
    ... context of the question is in regard to layer 3 architecture. ... are using a central set of 'core' switches that effectively own all ... vlans, as well as have vlan interfaces (usually via an MSFC, but could ... this is a 'distributed layer 3' model in which your ...
  • Re: [OT] Layer 3 switching and vlans
    ... On Mon, 2005-01-31 at 10:38 -0600, Richard Humphrey wrote: ... You would need switches in building B that could support VLAN trunking ... VLANs are not really layer 3, tags are added to ...
  • Re: DNS replication on 2 domain on 2 forests
    ... Switches "route" (hate to use that term with a switch since it is confusing ... Network layer is where IP addresses live. ... Routers work on that layer. ...