Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to set up a new network for a client that will be leasing parts of their office space and providing shared access to internet and printers. Here are the details:

  • Internet access will be shared between tenants.
  • Tenants cannot see each other.
  • Tenants can see a group of shared resources (printers, scanners).
  • Tenants may require using their down DHCP server for VOIP phones or their own AD domain. (optional requirement)

I"m looking for recommendations on how to set up the switch(es) and router(s) in order to accomplish this. Specifically, i'm not sure how VLANs operate when sharing resources or an internet connection.

Any insight would be appreciated.

share|improve this question
up vote 9 down vote accepted

Put every tennant into its own vlan, and shared resources in a separate vlan, and set up routing between them.

Each vlan is like a 'switch-within-a-switch'. If ports 1-4 are in vlan10 and 5-8 are in vlan20, then it's the same as having 2 4-port switches in one box. Uplinks are "combined" as a trunk-port.

Connect the router to a trunk port, and set up vlans on the router (you get a "virtual interface" for each vlan, so again, same as with many different switches and interfaces connecting to them, but with just one cable and one real interface), and set up appropriate routing and firewall where needed (routing shouldn't be a problem and should work immediately, but all the tennants will be able to reach all the other tennants' networks without some firewall rules/ACLs).

Set up rules to dissallow connections from one tennant network to another, but allow connections from all internal networks to shared-resources network.

Sharing the internet connection is a bit tricky if you need public addresses, but if you're behind nat, just enable nat on all interfaces where it is needed.

share|improve this answer
This is absolutely correct, this is basically what VLANs were made for. – Matthew May 23 '12 at 15:45
Thanks for the great info. Do you think a Cisco ASA 5505 or another 55* model will be ok for the router? Or is there something else I should be using? – JWright May 23 '12 at 16:08
I'm not a cisco guy, so I cannot help you with that, but AFAIK Cisco ASAs are primarily firewalls and not routers, but I am not sure if they can act as routers too. – mulaz May 23 '12 at 16:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.