Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to give access SQL 2008 R2 server for all users who logon from the production VLAN but only to one group when packet comes from the development VLAN. SQL server is within production LAN.Does not seem like I can do it either with SQL server or IPsec (Windows firewall)

share|improve this question

There is no notion of a "VLAN" either at the SQL server service level or at the Windows Firewall level. So you cannot use the vlan tag parameter in any rules, roles or group memberships.

Although you could set up firewall rules to only allow certain IP addresses or address ranges (which might "translate" to a specific VLAN in your configuration), creating an AND-like condition where a user is only allowed to log in if in member of group A AND his request is coming from VLAN X or subnet A.B.C.D/26 is not possible.

share|improve this answer
Thank you.I guess I was did not as correct question - by VLAN I meant subnet, not VLAN tag.Hopefully there are ways to do it.. – Sergei May 26 '11 at 7:55
You only can assign users to groups (server level) or database roles (database level), the database objects can only be assigned with access controls in regards to users and roles - not subnets. On the packet filter level (Windows Firewall) you can either filter the dev subnet so the SQL server is not accessible from there at all, or allow the dev subnet - in this case anybody who has correct credentials will have access to the SQL server. There is no way to set up a logical AND interconnection between these two conditions in the manner you'd like it to work. – the-wabbit May 26 '11 at 9:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.