Office network and guest network - manage with separate physical servers or a VM on the office server?

Question

I have a beefy server (dual Xenon & 16GB RAM with RAID5) I use as the domain controller and file server for an office network on a dedicated internet connection.

I also have a guest network with wifi access and a few public workstations for guests to use with its own dedicated internet connection.

The guest computers are not centrally managed, but I would like to change that and set up the guest network with its own domain, but still keep it completely segregated from the office network.

I plan on using the guest network's server for locking down the workstations with GPO, deploying new images to workstations, and managing deep freeze on the guest workstations.

There were two options I was considering:

1) Set up Server 2008 on a desktop workstation (Dell Optiplex 330) with a RAID mirror and put it on the guest network. While this is simple and straight-forward and ensures that the two networks are kept seperate, I'm a little hesitant to do this since it is not a very robust solution because of the possibility of a hardware failure (but if there is a failure, I have a spare Optiplex 330 I could use for spare parts or to restore a backup to).

2) Install a new physical intel 10/100/1000 NIC in the office server and set up a seperate VLAN on the office network switches that connects the NIC to the guest network. Then, set up a Hyper-V virtual machine with Server 2008 to manage the guest network. While this solution would be robust, I'm hesitant to this since this solution uses the office network's switch's resources and because of security concerns in how to make the office resources on the server inaccessible from the guest network.

Which approach might you consider, or do you have additional suggestions for either (or additional) solutions?

Answer 1

I have a beefy server (dual Xenon & 16GB RAM with RAID5)

;) Really? That barely counts as mid range these days.

I would go with a VM, but you do NOT need a second network card if your swtich can properly transform VLANS - just put the gues network on another VLAN and then run it tagged on the main server port, untagged on the guest ports. Use switch QOS to limit guest bandwidth - finished. Every non trivial switch can do that - as my office low range netgear ProSafe switches.

This is a good enough isolation for all cloud providers, so it will be a good enough isolation for you ;)

I'm hesitant to this since this solution uses the office network's switch's resources and because of security concerns in how to make the office resources on the server inaccessible from the guest network.

Well, resource limits can be managed on the switch, but otherwise - seriously? There is NO known case of a VM breakout out of the VM box, that is extremely safe. Unless YOU create a hole manually (routing, not separating them properly on the Hyper-V side) you basically have a separate machine. Azure, Amazon Ec2, tons of cloud providers run hypervisors without people breaking out ;)

Answer 2

I vote for the second solution, just because it's the "standard" way to proceed when isolating network domains. But you'll have to setup and test an environment that effectively limits the resource usage for the guest network.

For what concerns the bandwidth usage inside the VLANs, well it depends uniquely on your switch, if it supports per-port or VLAN-based rate-limiting or not. For what concerns the VM, you have to allot to it just one core (if each of your Dual Xeons is at least dual core, otherwise you can have problems) and limit it's memory consumption to (let's say) just 3-4GB. In my (not so recent) experience with VMs, I noticed that their memory consumption slowly increase over time: so You may also have setup a procedure to shut down and restart the VM from time to time (let's say every week-end).

Your doubts about security should be unfounded. Guests can't see anything outside their VLAN and shouldn't either be able to break through the VM to reach the host.