Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let me start by telling you that I'm not very technical, but need to provide someone with some guidance and I was hoping you could assist.

The situation is:

  • Dev and Prod subnets (Not sure if they're in different VLANS, but on diff subnets)
  • Current in-house developers apparently need access to both prod and dev networks, so completely segregating them may not be an option
  • They now also need to provide access to an offshore dev company to the dev network, but keep prod secure

They have a FW and a Citrix gateway, and were looking to setup VPN access to their network. Any thoughts on how best to approach this?

share|improve this question
up vote 1 down vote accepted

Put development and production in different VLAN's, put a VPN from offshore to your company. Allow inter-vlan routing from dev to production, allow routing from dev to VPN. Disallow any traffic from offshore to production. Enforce this with a firewall/ACL. Maybe set up an IDS on your VPN to dev.

This is the best I can come up with as probably completely segregating these networks is not an option for you. The only way to compromise your production would be if somebody from offshore was able to get into a dev machine. So make sure you enforce a firewall policy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.