What is the minimum implementation that ensures some test servers (like domain controllers) don't send out network traffic that crosses over with production systems? The purpose would be to setup a test environment that does not interact in any way with production systems 'by accident.'

Are separate VLANs simply enough?


When architecting networks and discussing trust boundaries, there are a few things to keep in mind:

  • Physical segregation
  • Logical segregation

If at all possible, you should start with physical segregation. This means the test network is not connected to the same switches and other network gear that production is. This may not always be possible. For example, if this is a lab environment where people can walk in to a room and interact with this test network, great. Or, if there is a VPN that can be placed in front of the segment to allow centralized interaction, that's another option.

However, there must also be logical segregation. This means network routing (including VLANs) must not allow connectivity between each network. Crossing these boundaries is something I use in pentests. It's usually easier to break in to a dev or QA environment and then pivot up than it is to break in to a production environment.

So, it is going to depend on a few factors that really only you can answer:

  • Business needs
  • Ability to orchestrate network segregation (including network fabric configurations)
  • What kind of risk you are willing to assume given the above two

There is far more to properly architecting a network than I can write here, and much of it will depend on information I don't know, or want to know. This will include the current architecture of the network, services running, and what those business needs are.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.