Our company is moving to a new building, where all access switches are managed by the IT Staff of this building, it means that we will not be able to manage them, and in some way all companies in different floors will be using the same physical network. We are going to be given a VLAN (as many as we wanted) to separate and isolate our network from others.

The question is, how can I ensure that even the IT staff from the building won´t be able to access my VLAN? (They could configure any port on any switch (from any floor) to access my VLANand then access my entire network)

Is there any solution for scenarios like this?

migrated from meta.stackexchange.com Mar 7 '18 at 19:32

This question came from our discussion, support, and feature requests site for meta-discussion of the Stack Exchange family of Q&A websites.


If you regard the shared network as 'hostile' like the Internet, VPN is a rather obvious choice.

You could connect VPN routers with their 'unsafe' interfaces to the shared network and connect your clients (or private switches) to the 'safe' router interfaces.

The shared network admins could still disrupt communication but they wouldn't be able to listen in or tamper with the data.

A simpler approach would be to end-to-end encrypt all connections using SSL (as in HTTPS) but that would still expose the 'ground-level' communication.


There is no truly good way to secure this type of setup against the building's IT staff whom you also do not trust - not without having separate networks behind a gateway and corresponding network infrastructure that you actually can control (thereby defeating the purpose of the VLAN's existence in the first place) which would then be connected to the VLAN in order to get 'internet' access to the networks behind that gateway.

Since you cannot control the switches, you cannot really control access to the network. You can't implement proper port lockdown rules, you can't implement network-level restrictions, and you can't shut down ports on the switches to protect against access to the VLAN.

In order to really protect a network like this where you don't control the physical infrastructure that comprises the network, the only option would be to run your own network, using the VLAN as an 'access' tunnel to the Internet or other network ranges, with another firewall or appliance behind the scenes connected to your own network of switches and endpoint machines, thereby keeping data contained to within your network's borders.

The other option is unfortunately similar - it would be to set up a secure gateway device running a properly-configured VPN in the VLAN that in turn has everything else behind it except endpoint computers. Endpoint computers then have to connect via VPN to the 'gateway' box, and then they would have access to the devices and information you want to protect. From there, then depending on subnetting, user authentication, etc. you can configure access to devices within your own 'sphere of control' behind that gateway device (whether it be a Cisco ASA or a pfSense box or some other type of device, is up to you). However, this still necessitates your having a 'second' network that is internal holding the data you want to protect within it, and you just treat the building-wide VLAN as the 'Outside' or WAN connection to the gateway appliance for these purposes.


You can use a standard router so you can isolate your local network from the building. Just treat the building as the internet. For example you can use a WiFi router, connect the WAN port to the switch that is on your floor. The IT staff must provide the standard connection data like IP/Mask/Gateway. The problem is that you can't use the physical network of the building on your staff area, you must have your own cables or use the WiFi (that goes to your router).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.