[es] - Vise mreznih segmenata

Iznogud
Subotica

Član broj: 1721
Poruke: 212
*.sever.co.yu.

Profil

^{31.01.2005. u 13:13 - pre 234 meseci}

Treba mi jedan savet. Naime, u firmi postoji poprecna veza sa provajderom i lokalna mreza i sve funkcionise OK. E sad, povecava se broj korisnika i potrebno je LAN segmentirati na 2 (ili 3 segmenta). Jedan od segmenata bi trebao da bude potpuno (!?!) zasticen od ostala dva segmenta ( i naravno od napada sa interneta). Drugim recima, ne sme se dozvoliti da neki od racunara iz segmenta 2 ili 3 pristupi bilo kojem fajlu bilo kog racunara sa segmenta 1, s tim da naravno racunari unutar segmenta 1 mogu normalno da komuniciraju po pravilima koja se definisu (razmena fajlova kroz shairing-ovanje foldera, diskova, itd.).
Ova zastita od upada sa interneta mi je manje vise jasna, postoji router + jos jedan linux firewal + DMZ, i to manje vise sljaka. Zanima me ova medjusegmentna komunikacija. Pada mi napamet da postavim ispred segmenata jedan linux firewall/router sa 2 ili 3 mrezne kartice pa da sa iptables regulisem taj saobracaj medju segmentima. Takodje razmisljam i o Sambi kao kontroleru domena - koliko je to dobro - da li koristiti obicni workgroup ili domain kontroler (sambu) - user level umesto share level? Da li Samba moze kontrolisati vise domena/podeomena - recimo poddomen za svaki od segmenta?
Ako neko ima iskustva sa ovim stvarima, neka mi predlozi neko kvalitetno resenje.

Odgovor na temu

mika
NBG-ML

Član broj: 55
Poruke: 640
*.privsav.co.yu.

+1 Profil

Re: Vise mreznih segmenata - zastita

^{01.02.2005. u 08:05 - pre 234 meseci}

Khm, grešiš Iznogude, postoje itekako upravljivi switchevi, i njima se najlakše konfiguriše mreža koja treba da je segmentirana.

Intelligent Ethernet Managed Switches
Intelligent Ethernet switches provide a number of advanced features
for factory automation. First, the user can set up virtual LANs
(VLANs) to segment devices into logical workgroups. VLANs allow
end-devices to be grouped together (in the same subnet, for
example) even if they are in different locations. Therefore, machine
controllers in one building can be grouped together with machine
interfaces in another and treated as if they were physically next to
each other.
A second major advantage of intelligent Ethernet switches is their
ability to manage multicast traffic. Instead of flooding that traffic to
all users, they use Internet Group Management Protocol (IGMP) to
direct the traffic only to the desired recipients. Some packet line
cards and multiple I/O devices have a limited capacity for received
packets, and by using IGMP, an intelligent Ethernet switch can
protect those end devices from unwanted traffic.
The third major advantage is QoS and queue management. By
assigning a priority to time-sensitive data, intelligent Ethernet
switches can elevate that traffic above lower-priority data. This
ensures that high-priority traffic always traverses the network even
if the network becomes congested. Without QoS and queue
management, high-priority traffic may be delayed or dropped during
congested periods.
Intelligent Ethernet switches allow the user to set up 801.q trunk
interfaces. Via these trunk interfaces, traffic is marked with tags to
indicate the particular VLAN the end device is in and the QoS
priority for that particular data stream. Without the ability to set up
trunk interfaces, there is no way to mark and pass on the QoS
values, or to identify the VLAN origin of the data stream.
Lastly, intelligent Ethernet switches provide mechanisms to ensure
network security via protocols such as 802.1x, port security, MAC
address notification, Dynamic Host Configuration Protocol (DHCP)
interface tracking, and many more. Each feature can be configured
and tailored to the particular needs of the factory floor. By using
access control lists (ACLs), certain traffic patterns can be directed to
specific ports, preventing network intruders from accessing critical
information. Likewise, by using these same ACLs and some of the
QoS features mentioned above, the intelligent Ethernet switch can
prevent an intruder from congesting the network.

Try: http://www.cisco.com/applicati...migration_09186a008014db75.pdf

Bolje 100 godina biti milioner nego nedelju dana siromašak
(c) Alan ford

Odgovor na temu