Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work in an industrial plant and we have one network(physical wire) that us used for both office usage and for process systems. The office computers are only used for typical office needs but occasionally do connect to the process computers to obtain information from a sql server or for some other purpose.

A new initiative is in the works and is rolling down hill from corporate and that is to standardize how the the computers are used at work and they would be severely locked down and only a standard set of applications will be allowed to execute.

one of the requirements is to also have non office computers isolated from the company domain. our non-office computers are a mix of Man-Machine interfaces and sql-servers all running software that non standard.

My question is, how can we divorce the control systems computers from the company domain but still have access to the servers from the company domain.


share|improve this question

migrated from Apr 29 '10 at 15:37

This question came from our site for professional and enthusiast programmers.

Consider using different VLANs for each role, and using a firewall to pass traffic between them. The firewall will, of course, be configured in such a way to only allow the appropriate traffic through.

share|improve this answer

Split up the two networks completely and put a firewall between them (or just isolate the process network). There is no reason to expose process systems like that.

Once this is done you have to consider how to access the databases in the process part of the network. There are many solutions (port forwarding, SQL proxy etc) but my personal recommendation would be to setup a new SQL server, dual home it both in the process and the user network and replicate all the data users need access to to this host. Then make sure you lock down the SQL server as far as possible.

share|improve this answer

If you don't wan't to start doing some fancy networking, you can do Private VLANs. Higher ends Cisco switches can do this.

share|improve this answer
that's the way to do it; but you don't need high-end switches. any 'manageable' one can do. look for 802.1Q capabilities – Javier Apr 29 '10 at 20:05
Well I disagree. 8021Q is different then private VLANs. 8021Q is regular VLANs. Private VLAN allows you to filter communication in the same VLAN. This would allow him to not add some extra routing. – Antoine Benkemoun Apr 30 '10 at 7:13
interesting, i didn't know about that one. Of course, the original question asked about splitting a LAN in two, no need to filter within one group. ... and, not knowing about private VLANs, i've already reimplemented one, simply by creating one-port 802.1Q VLANs, and joining them by a linux with ebtables, not iptables. that lets me filter on a bridge, not only with a router. Only advisable on low-bandwith uses, of course, but the private VLANs seem to have a similar limitation. – Javier May 3 '10 at 19:53

Would be easiest to put some type of router or firewall in between the two segments and setup an ACL to allow for only the traffic you specify to traverse between.

This is assuming the process computers are simply machines on the network and not connected to the domain.

share|improve this answer

I'll third the "vlan" statement.

Use switches that speak 802.1q vlan tagging, then setup different subnets for the different bits of functionality, then implement ACLs at the Layer 3 hop between the two subnets (the router).

Now -- here is the most important possible addition --

Add rate limiting to the L3 hop and on all the ports on the "corporate" side of things so that your standard PCs can't overwhelm that link and ruin the "control" network. It would be a sad day if someone decided to ghost a bunch of machines on the corporate network and that caused your robotic lasers to vaporize half the factory...

share|improve this answer

Moving them to various LANS will not stop group policy from propigating to them (which is most likely how they are going to lock them down). The best thing to do- regardless of vlan is to place these servers into seperate Ous in AD and block the policies that are not applicable to them

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.