Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

Suppose there are 50 developers who access the server hosting the version control system (subversion for example). Would you put developers and svn server to same vlan (since this communication is very common and svn is accessed outside of this group very rarely) or to separate vlans (since svn server is a server not a user) ? What is the reasoning behind such a decision ?

Thanks.

share|improve this question

closed as not constructive by Zoredache, womble, HopelessN00b, Michael Hampton, Ladadadada Sep 5 '12 at 11:34

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

3 Answers

up vote 2 down vote

VLAN usually designed to partition network traffic to alleviate broadcasting. It can be used for security when you really need to isolate traffic. But SVN has some security by itself. Unless you are coding a new version of Windows and need to be paranoid to prevent leaking - VLANing is too much to do for your purpose.

share|improve this answer
If I add there are other users also that should not see svn so easily (some kind of network security issues) and there are other servers also in the network, then how do you think it would be better to make the partitions ? – mete Mar 30 '12 at 9:30
If SVN server is used only for SVN purposes, you can add it into the same VLAN where your users are. General principle of partitioning is a 'workgroup'. Problem usually comes when those users need to access some other server, which, in turn should be either in same VLAN or some sort on inter-VLAN routing must be configured (you would need smart L3 switch for that). Detailed info you can find [here] (automation.com/resources-tools/articles-white-papers/…) – Dada Mar 30 '12 at 10:27
up vote 1 down vote

Seriously? Given that the minimum speed for a sensibly set up LAN is anyway gbit and that there is no benefit in contention control PURELY from VLAN (without additional configuration), why bother? Security may come in, but for most scenarios is not relevant enough for the additional work.

share|improve this answer
up vote 0 down vote

In a site or office a big as yours I would recommend separating clients (workstations, etc) from your servers. Depending on the trust levels, you can join those networks with a router (a layer 3 switch) or a firewall. The main reason for having this separation is it gives a point of control and inspection if you need to. You can block individual IP addresses, or protocols by TCP port, as well as report on that activity. Even if you don't enforce anything normally, you have the capability to it easily when you need to. If something abnormal is happening in your network, and you want to start chasing things down, you can do that most easily at a router or firewall interface. Of course it also allows you to have servers that have restricted access under more severe control, for instance your finance servers or backup servers.

These days even mid-range switches have layer 3 routing capability, and all are able to perform routing as fast as regular switching with their custom ASIC chips.

share|improve this answer
Thanks Martyvis. This is exactly what I have in mind (we will use a l3 switch) that is to separate users, developers, internal servers and external facing servers. I am only not sure about internal servers such as svn or a file server that is only used by users (not developers). Is it better to put them into internal servers vlan or put them into developers and users vlan ? What would you do ? – mete Mar 30 '12 at 9:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.