3

I am wondering if I need to buy a switch which is managed (VLAN support) for my configuration, or will a cheaper unmanaged switch work?

I have servers with two NICS each. The first NIC is public and the second NIC is private. The router will plug into the switch port 1 let's say (public). Then server 1 public plugs into port 2 on the switch, and sever 1 private plugs into port 3 on the switch. The public interface is: 192.168.X.X / 255.255.0.0 and the private interface is 10.0.X.X / 255.255.0.0.

So looks like:

 ** SWITCH **
 Port           Device                Network  
 1              Router/Firewall       192.168.X.X
 2              Server 1 Public       192.168.X.X
 3              Server 1 Private      10.0.X.X
 4              Server 2 Public       192.168.X.X
 5              Server 2 Private      10.0.X.X
 6              Server 3 Public       192.168.X.X
 7              Server 3 Private      10.0.X.X

Thanks.

Improve this question
3
  • You do realize that 192.168.X.X is not publicly routable?
    – GregD
    Jan 3, 2011 at 4:47
  • Yeah, 192.168.X.X is the routers ip range which has one-to-one nat configured.
    – Justin
    Jan 3, 2011 at 4:55
  • Just making sure. We get a lot of drive-by questions from new folks and wanted to be sure you knew that.
    – GregD
    Jan 3, 2011 at 4:57

4 Answers 4

Reset to default
7

Putting your public and private networks on 1 VLAN is a security no-no. It will probably work, but it's worth the small investment for a semi-managed switch.

Improve this answer
4
  • OK, makes sense, any recommendations on a cheapish 24port or higher 10/100/1000 switch that supports VLANs?
    – Justin
    Jan 3, 2011 at 4:52
  • Look at the Dell Powerconnect 2800 switches. Decent and cheap.
    – Jason Berg
    Jan 3, 2011 at 6:04
  • I've heard that dell switches are just rebranded SMC and dodgy quality. I've bought HP ProCurve instead.
    – ptman
    Jan 3, 2011 at 6:57
  • @ptman -I used to feel the same way (purely because it isn't Dell's core business area, so how good could they be?) but we had some powerconnect switches as part of a "package deal" with Dell and they are surprisingly good; fast, reliable, stable, very good support. We're using them as part of an iSCSI fabric and their performance has been faultless, enough so that we're looking to buy some more for the same job, despite normally being a HP Procurve kinda outfit for everything else.
    – Rob Moir
    Jan 3, 2011 at 8:39
4

Or you can just buy two unmanaged hubs/switches, one for public and one for private. That's a little more secure since there is no possibility of a mis-configuration mixing the two.

Managed switches are good if you are going to manage them. You can get traffic stats, for example.

IMHO, VLANs are a bit over-used.

Improve this answer
1
  • 1
    This is a very good point. If two unmanaged switches works out cheaper and gives the config required then it's a valid solution. And managed switches are only worthwhile if you're prepared to make the effort to configure them properly and so-on. Some people don't have the time or skillset for that.
    – Rob Moir
    Jan 3, 2011 at 8:42
3

A switch is a OSI layer 2 device. Thus it doesn't care about the IP protocol and addresses.

Without configuring VLANs the switch and the networks should behave properly.

However

  • All servers/devices sharing the switch will receive broadcast information.
  • That information is commonly dropped by non-interested hosts, but a machine may configure the card to listen in promiscuous mode to collect data from a network she is not part of.
  • Any machine has access to any other machine (by adding an IP address for instance to her own card that belongs to a network she is not part of).

Depending on the price difference, and how security and privacy are an issue, I would advice the VLANs able switch. Another reason is that usually those devices benefit from a better build and a stronger internal firmware.

Improve this answer
2

Depending on your application, a software firewall inside the OS might be good enough, but a NIC isn't private just because you label it private. The NICs are on the same broadcast domain, and any NIC on that broadcast domain can communciate with any other NIC on that broadcast domain. If you want this to not be the case, you need either physical or logical network separation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .