Re: VLANS in a DMZ - good idea?

From: Greg Hennessy (me_at_privacy.org)
Date: 01/26/05


Date: Wed, 26 Jan 2005 17:22:44 +0000

On 26 Jan 2005 05:40:10 -0800, dgunner@lycos.co.uk (Damian) wrote:

>I am looking to setup a new perimeter network for a client and am
>contemplating the following setup as they have a spare L3 routing
>switch to hand.
>
>
>The L3 switch will have each port assigned to a separate network, one
>for mail, one for the extranet and one for the outbound proxy.

Using VLANS to provide logical and physical seperation in a DMZ(s) is an
excellent idea as long as all the configured VLANS are at the same trust
level on the switch.

If its a crisco take a look a configuring up private VLANs on each
endpoint.

http://www.cisco.com/en/US/about/ac123/ac114/ac173/ac222/about_cisco_packet_feature09186a0080142deb.html

greg
 

-- 
Yeah - straight from the top of my dome 
As I rock, rock, rock, rock, rock the microphone