Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a beefy server (dual Xenon & 16GB RAM with RAID5) I use as the domain controller and file server for an office network on a dedicated internet connection.

I also have a guest network with wifi access and a few public workstations for guests to use with its own dedicated internet connection.

The guest computers are not centrally managed, but I would like to change that and set up the guest network with its own domain, but still keep it completely segregated from the office network.

I plan on using the guest network's server for locking down the workstations with GPO, deploying new images to workstations, and managing deep freeze on the guest workstations.

There were two options I was considering:

1) Set up Server 2008 on a desktop workstation (Dell Optiplex 330) with a RAID mirror and put it on the guest network. While this is simple and straight-forward and ensures that the two networks are kept seperate, I'm a little hesitant to do this since it is not a very robust solution because of the possibility of a hardware failure (but if there is a failure, I have a spare Optiplex 330 I could use for spare parts or to restore a backup to).

2) Install a new physical intel 10/100/1000 NIC in the office server and set up a seperate VLAN on the office network switches that connects the NIC to the guest network. Then, set up a Hyper-V virtual machine with Server 2008 to manage the guest network. While this solution would be robust, I'm hesitant to this since this solution uses the office network's switch's resources and because of security concerns in how to make the office resources on the server inaccessible from the guest network.

Which approach might you consider, or do you have additional suggestions for either (or additional) solutions?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

I have a beefy server (dual Xenon & 16GB RAM with RAID5)

;) Really? That barely counts as mid range these days.

I would go with a VM, but you do NOT need a second network card if your swtich can properly transform VLANS - just put the gues network on another VLAN and then run it tagged on the main server port, untagged on the guest ports. Use switch QOS to limit guest bandwidth - finished. Every non trivial switch can do that - as my office low range netgear ProSafe switches.

This is a good enough isolation for all cloud providers, so it will be a good enough isolation for you ;)

I'm hesitant to this since this solution uses the office network's switch's resources and because of security concerns in how to make the office resources on the server inaccessible from the guest network.

Well, resource limits can be managed on the switch, but otherwise - seriously? There is NO known case of a VM breakout out of the VM box, that is extremely safe. Unless YOU create a hole manually (routing, not separating them properly on the Hyper-V side) you basically have a separate machine. Azure, Amazon Ec2, tons of cloud providers run hypervisors without people breaking out ;)

share|improve this answer
    
I'm not concerned about the VM "breaking out". What I meant was, a physical NIC would be connected to the guest network. What measures would I need to take to protect the physical server? –  Force Flow May 25 '12 at 12:33
    
Well, as long as the NIC is gong through a network setup that is not tdone y someone without a clue then you can control everything via VLAN and VLAN to port allocations on your switch. –  TomTom May 25 '12 at 17:21
    
I didn't quite understand your response. Computers on the guest network will still need two-way access to the physical NIC in order to reach the VM. I'm not quite seeing how a VLAN will block access once the traffic reaches the NIC. –  Force Flow May 25 '12 at 20:46
    
The VLAN traffic will not be visible to the internal servr but only to the server that is listening to the tagged packets. In Hyper-V you can put up every virtual NIC to only listen to specifically tagged traffic. Make sure the guest traffic reaches the server tagged, then add this tag to the hyper-v virtual nivc ovf the guest machine. THis is what VLANs are for. –  TomTom May 26 '12 at 15:25

I vote for the second solution, just because it's the "standard" way to proceed when isolating network domains. But you'll have to setup and test an environment that effectively limits the resource usage for the guest network.

For what concerns the bandwidth usage inside the VLANs, well it depends uniquely on your switch, if it supports per-port or VLAN-based rate-limiting or not. For what concerns the VM, you have to allot to it just one core (if each of your Dual Xeons is at least dual core, otherwise you can have problems) and limit it's memory consumption to (let's say) just 3-4GB. In my (not so recent) experience with VMs, I noticed that their memory consumption slowly increase over time: so You may also have setup a procedure to shut down and restart the VM from time to time (let's say every week-end).

Your doubts about security should be unfounded. Guests can't see anything outside their VLAN and shouldn't either be able to break through the VM to reach the host.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.