Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm just looking for advice/best practices on how to properly segment my network with the goal of it being as secure as possible, but also easy to manage.

Currently, the network is flat and almost internal PCs, servers etc are on the same subnet, with the exception of a DMZ for all internet facing servers. I have a FortiGate 80c and two 3Comm Managed switches. I want to separate all production servers, IT personal, and the rest of staff.

My main question is should I try to manage it all through my router, and break the "Internal Ports" (6 of them) on my Fortigate, so I can have a few different internal interfaces? This way, I could easily subnet each network group (sales, IT, production servers) and then have policies enforcing which network can see what. Basically, create a few DMZ type setups. I'd have a switch for each group, and plug each switch into the corresponding internal port on the Forigate.

Alternatively, I could create VLANs in my switches, and then have my Fortigate separate the VLANs into different subnets.

I suppose I'm hesitant to do option 2 because it seems like a lot of work (I'm not familiar with the managed switches setup) and then I'd have to worry about managing switches in addition to the FortiGate.

Any input or advice would be much appreciated!

share|improve this question
It sounds to me like you're adding complexity without having any real reason to do so. Define for us what "security" and "manageability" you're lacking that this undertaking will solve for you. Doing something for the sake of doing it or doing it because you heard that it's good practice, without having identified a real need or problem for yourself isn't a good reason to do it. So all of your devices are on the same subnet, I say "so what?". What problem is that causing you? How does segmenting the network make it easier to manage? What security issue are you solving? –  joeqwerty Nov 29 '12 at 21:07
"currently the network is flat" - congratulations, you've achieved what Cisco, Juniper, and others are currently marketing as the next big thing with fancy monikers and lots of ad dollars! –  TheCleaner Nov 29 '12 at 21:10
We're being audited and they're making us segment the network. I suppose the theory is that if a sales computer gets compromised, there's no chance if affecting a production server. It seems like a good idea, but there appear to be several ways of accomplishing it. Just wanted to see if there was a clear cut winner. –  Chris Nov 29 '12 at 21:25
@Chris Auditors? Restrain, don't be tempted to take a part of the blame on yourself. The only person in trouble is apparently your boss, for not hiring a decent network architect in the first place. Are you a trained network architect? Do you want to be one? Do you want to have your first assignment at the time of the audit? –  kubanczyk Nov 29 '12 at 21:40
@Chris - your idea of a virus not compromising other vlans isn't correct. –  TheCleaner Nov 30 '12 at 0:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.