Well so I want create multiple networks so that they exist in isolation from each other.

It aims to ensure that it: a) has no redundant hardware (mail exchange, infrastructure, etc only once for all networks, but safe with isolation) b) the networks do not threaten each other (a compromised network that will not affect the others have) c) an exchange of data between the networks to be possible.

How do I put on the best approach? The networks have indeed because of their functions different requirements (sensitive data, isolation, external access to web, etc.).

I thought about a lot of work with terminal servers or through static routes in a direction to ensure the safety to charge the external server is not compromised internal server?

What are alternatives? Is there a best-practice how to build a corporate network?


Agreeing with user34092's comment, you can almost set up what you want using firewalls with multiple interfaces. Creating separate networks and applying rules to allow certain traffic between networks/interfaces would probably be the best way to accomplish what you want.

  • Yep. Connect each network to a separate interface on the firewall, then 'punch holes' between the networks to allow just the data transfers that you require. If your users connect to one of the networks but need 'rich' access to the other one, raise a TS in the secured network and punch a single hole through for RDP access. – Chris Thorpe Feb 7 '10 at 23:21

If you are transferring data between the networks, by definition they threaten each other. The only completely secure network is one that's in complete isolation.

  • how to manage exchange? copying files etc.? – Anonymous Feb 7 '10 at 18:44

Probably the best approach I've seen so far (in my experience) is to have firewalls setup on every single machine, and poke holes in the firewall for each machine for any other machine that needs to communicate with it.

I know, it's a huge PITA - but you can be as granular as you want, and depending on how your IP space looks like, you can even be a bit more 'loose' by punching holes for a network with an associated subnet mask.

Another thing I've seen is to use VLAN's very liberally with each subnet, and isolate traffic that way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy