0

From what I understand, a VLAN makes administration easier and, in many setups helps with security.

If I have one database server and a few (3-4) application servers communicating with the database, with no communicaton between application servers, do I need a VLAN?

I can just open one port for each aplication server on the database server and I am "secure", correct?

Can someone please explain if there are any advantages of a VLAN in this and similar cases?

I am asking this because many providers, charge extra to setup a VLAN between servers, for example OVH vRack.

2

VLANs are Virtual LANs. As such they restrict which hosts can talk to each other. They can be an important building block of a secure network where certain resources, such as a database server, management interfaces, etc., should only be accessible to a much more limited set of people/machines/services.

For example if you had a webserver that connected to a backend database on another server you might have: 1.2.3.1 VLAN1 1.2.3.4 5.6.7.8 VLAN2 5.6.7.9 Internet <---> Router <------------> Webserver <--------------> DB Server

Thus your database server cannot connect to the internet (no route and because of the VLAN, no physical connection) and conversely for an attacker to reach the database server, they would have to "pivot" through your webserver first.

In many instances, you can achieve similar security objectives by making use of strict firewall rules or tcpwrapper. For example, if the DB server should only be receiving connections from the webserver, create a rule that does that. The same should be done for your management protocols, like SSH.

In the end, yes, VLANs can be used as one part of a layered security model. You should also employ firewalls, authentication, updates, and many more controls as part of a defense-in-depth strategy.

There is a good question on StackExchange's security site regarding VLANs. Why do people tell me not to use VLANs for security?

2

I'd say that entirely depends on what you consider "secure". A VLAN is a virtual local area network. An easy way to think of it is as physical switches. If you plugged all your servers into one switch, and your database server into another switch, and had a firewall or router between the two. VLANs essentially behave the same, except they are all on the same physical switch (or switches) and divide up the ports to different LANs. You'll still need some device to route between the VLANs such as a firewall or a router, where you define the rules of what can and cannot get between the VLANs.

In terms of security, it's a logical separation of traffic, and one that allows you to control access between devices. For example, you only allow database access from the application server to the database software port (ie 3306 for MySQL), which would mean you cannot launch SSH or RDP from the app server to the database server. This reduces the risk of somebody compromising the application server, and having easier access to the database server. These can also be managed through good server firewall rules as well.

This is usually considered one of those "first steps" in regards to security and separation of roles (Management of database servers should only be accessible from trusted hosts for example). However, this kind of thing doesn't protect against poor application code, or database permissions issues, or database software bugs.

1

A VLAN (Virtual Local Area Network) is a logical collection of devices that are grouped together to control broadcast, unicast and multicast traffic in layer 2 devices, such as an ethernet switch. VLANs can be locally significant or be trunked over multiple layer 2 devices.

VLANs provide the following benefits:

Security – Separating systems that have sensitive data from the rest of the network decreases the chances that people will gain access to information they are not authorized to see.

Performance/Bandwidth – Careful monitoring of network use allows the network administrator to create VLANs that reduce the number of router hops and increase the apparent bandwidth for network users.

Broadcasts/Traffic flow – Since a principle element of a VLAN is the fact that it does not pass broadcast traffic to nodes that are not part of the VLAN, it automatically reduces broadcasts. Access lists provide the network administrator with a way to control who sees what network traffic. An access list is a table the network administrator creates that lists which addresses have access to that network.

Departments/Specific job types – Companies may want VLANs set up for departments that are heavy network users (such as multimedia or engineering), or a VLAN across departments that is dedicated to specific types of employees (such as managers or sales people).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.