3

At the moment our all computers in one big LAN, it is the intention to separate the admin and edu (it's in a school) especially for traffic and less for security. How do this best?

Network Diagram (Current)

Firewall?, VLAN?, IPCop (no two green zones)?, pfsense? ...

Should there be two scopes on the dhcp server (WIN 2008 R2), one for admin and one for edu or is one scope enough?

I would like your advice, I am a student in training with this task as a project.

Thanks

7
  • are you wanting to fully physically seperate the network into 2 discrete networks sharing a firewall/internet connection? or are you just looking to seperate the traffic for logging etc? Feb 28, 2011 at 15:18
  • A drawing would help -- upload it to flickr, yfrog, img.ur or something similar if need be :-)
    – voretaq7
    Feb 28, 2011 at 15:30
  • fig at flickr => flickr.com/photos/60078899@N02/5485668813 Feb 28, 2011 at 16:58
  • what did you use to draw this diagram, could you post a link please!
    – seanl
    Feb 28, 2011 at 18:49
  • 1
    @seanl - looks like it was drawn in Microsoft Visio to me... Mar 1, 2011 at 4:29

2 Answers 2

2

I consult to a lot of Australian private schools and their best method is using VLAN's. One for staff, one for admin and one for students.

By doing this, the schools security devices can be easily setup and maintained for students, without restriction staff or admin too much.

In schools I see 4 types of traffic. Administrators, Staff (non-teaching), Teachers and students. Currently most private schools are adding in 2 new groups, Parents and Alumni. The situation starts to become quite complex.

2 scopes in DHCP are fine, but you have alot more to setup, with switch port configuration. Agree with @voretaq7 Having 2 DHCP instances is far more effective than 2 nics in the one machine running separate subnets

First link describes a few different ways to perform a split - http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/9ae4e7dd-f73e-4cce-bdff-5913d5961c09

Second link is the actual deployment guide from microsoft for multiple subnets http://technet.microsoft.com/en-us/library/cc758865(WS.10).aspx

Another interesting note, most large private schools seem to use "Net Box Blue" as a filtering/firewall device, before a hardware firewall. http://netboxblue.com/ I hate the thing, but for smaller IT teams it works well.

Since it is a school project, I shouldn't really be answering your questions for you. LOL

1
0

This is a great project to take on as a case study in network design.

I don't think anyone on here is going to give you the whole answer (defeats the purpose as a learning exercise), but here are some practical pointers:
For a school you want to make your networks as separate as possible -- You want "physical" separation (different switching infrastructures, or at least different VLANs) as well as network/logical separation (different subnets).

Going through your questionmarked-items above:

Firewall?
Yes. Definitely. With appropriate rulesets.
Brand is up to you, but both of the ones you've mentioned are good choices IMHO.

VLAN?
It's cheaper than separate switching infrastructures :-)

Should there be two scopes on the DHCP Server?
There should be two DHCP servers (because your network will be split into two different broadcast domains). You'll probably also want a DC in each network.
If you want to get technical you should probably create a sub-tree in AD to hold the "edu" stuff (users/passwords/etc.) so it's separate from the administrative stuff

5
  • fig at flickr => flickr.com/photos/60078899@N02/5485668813 Feb 28, 2011 at 17:00
  • You don't need two dhcp servers or a domain controller in each network. As long as your servers support vlan tagging and the switch permits a port to recieve tagged packets from multiple vlans then what you have in your diagram works. Having seperate scopes will make it easier to troubleshoot ip issues so i would keep that. You won't need a firewall between the vlan's unless there's a legitimate need to share services. Just maintain a firewall on the external connection for monitoring & traffic mgmt. Apr 21, 2011 at 15:27
  • @Michael Henry - You can accomplish the separation with vlan tagging, but there are numerous other benefits to having a DC/DHCP box in each broadcast domain (assuming cost isn't a major obstacle) - redundancy and the ability to tighten access to the primary DC being the biggest ones.
    – voretaq7
    Apr 21, 2011 at 15:57
  • Sure there's a world of things you can do, but this is a student and a school, and from my experience everything has to be done on the cheap unless there's a justifiable 'educational' need. By primary DC what you mean is isolating student workstations from the admin groups DC. The trouble is with a completely isolated domain you now have to double up on all your administration. Profiles, patches & policies. No windows admin (teacher or pro) is going to want to work in that environment. Accept the risk, limit the services on the DC with windows firewall and patch regularly. Apr 22, 2011 at 13:43
  • The idea of having 2 VLAN interfaces on one server just for DHCP traffic is a crude one. Usually, you would implement a DHCP/BOOTP-relay on your routers to forward DHCP traffic to predefined DHCP Servers. If you are aiming for separation and use 2 different domains, maybe even with different admins, using 2 DHCP servers (one for each domain and the networks "belonging" to it) would be a good idea.
    – the-wabbit
    May 13, 2011 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .