0

We have bunch of servers with two NICs, one is configured with internal IP and one with external IPs. Planning to use a single switch to connect them all together.

Here is the current setup:

--Router---Firewall--ExternalSwitch--NIC1
                     InternalSwitch--NIC2

Each of the server has dual NICs and we are connecting one NIC to 'external-switch' and one NIC to 'internal-switch'.

Also there is no internal-router we are using one of the internal IPs as default gateway, which i think can be left blank? The idea of using one switch came up since the external-switch was a 8-port one and was running out of ports. What is the best way to use the dual NICs in our scenario?

  • 5
    What switch are you using? You should group your switch ports with VLANs or something similar. Also, what's the job of the internal and external routers? – Lukas Apr 8 '13 at 21:22
  • 1
    You'll want to set up VLAN's (if the switch supports it) to provide physical separation between the internal and external NIC's. – joeqwerty Apr 8 '13 at 21:23
  • 1
    @joeqwerty 'virtual' separation... – cpt_fink Apr 9 '13 at 1:51
  • True enough.... – joeqwerty Apr 9 '13 at 1:52
  • @roger This site is using Markdown for formatting - mostly, there is no need to mess with HTML tags. Take a look at how it works: serverfault.com/editing-help – the-wabbit Apr 9 '13 at 5:51
3

You don't tell us enough to really help you here, but I can tell you that your design as diagrammed is for all intents and purposes completely wrong (or vastly oversimplified, so as to lose all relevant information and thus be completely wrong).

As diagrammed you have no separation between internal and external networks (you're glomming everything into the same switch, presumably the same VLAN) which effectively negates any potential security benefits you might be hoping to gain - the only thing you might gain is performance if you routinely saturate one of the NICs (and that could be achieved through other methods).


To have any semblance of proper separation you need two switches (or two separate VLANs on a switch that supports VLANs). Internal communication should be completely isolated from external communication, as shown here

Example network, which still has big gaping security holes

Note that from a security standpoint even this illustrated configuration is still a terrible one. With a few rare exceptions you should never have a computer in the situation illustrated above (dual-homed with one NIC on the inside network and one NIC on the outside network) because it is a HUGE security risk: If someone compromises that machine they now have access to your internal network.

A better configuration would be a proper DMZ with restricted access through a firewall to internal resources.

  • thanks for the detailed reply. I have updated the question. So basically looks like we need to use NAT to assign public IPs instead configuring one of the NICs in each server with public IP? Understand there are other issues we need to fix along with this. – Roger Apr 9 '13 at 1:47
  • There's still not enough information in your question to tell you "what [you] need to do". Network architecture is not something that can really be done by a Q&A site - you need in-depth knowledge of the environment to come up with the best solution possible given the requirements. – voretaq7 Apr 9 '13 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.