vLANs

The IT manager here had some folks in to perform a security audit. I was a bit suspicious, since they were only scanning the internal network, and I didn't think that there was much, aside from some password scans, that could be accomplished (I'm more worried about outside attacks). One of the results of the audit was that we should create vLANs internally. We have 1 physical location, with 2 1/2 floors, and a total of about 180 workstations. We use level 2 switches. I don't know of a reason why we really should implement vLANs - anybody out there have an opinion?

Yes, it maybe necessary or appropriate in some circustances.
Could post here (without too much company disclosure) why the auditor team suggest that?
We can post them about their reasons and the suggestion itself.

The VLAN can create great value...


For example, I segment our software developers into several of their own VLANs.
They are always running protocol analyzers or packet sniffers to debug this or that. This sets off my IDS which required me to investigate which makes me want to scream.

I also like to segment workgroups like HR and Accounting from the rest of the corp for obvious reasons.

With a good enough switch, you can also have better bandwidth control over each group instead of doing rate shaping stuff on individual ports...Mostly on layer 3 equip tho.


Just a few ideas..

The first question is what do you have at risk, what value is it to the organization and thus what do you need to do, that doesn't exceed the value of the assets you are trying to protect, in order to properly protect them.

There's a huge difference between protecting the payroll records of a couple of hundred employees and protecting the SSN's and CC numbers of a few thousand members of the general public.

They were basing it on keeping traffic from getting overwhelmed in case of a worm. My reply was that the worm would still flood the router nic, so folks would still have problems with getting to resources outside of their relative vLAN anyway. The only time I've ever implemented vLANs was to ensure that the Finance department was able to get bandwidth to their production servers - single site/small offices doesn't seem to provide enough of a need for a vLAN that multiple sites/large networks would.

A worm should not be able to get to your trusted network if at all possible. There should be as few services as possible, preferably none, that are served to the public network from the trusted. AV protection should be automatically and centrally updated for all clients, or better yet all executable files should be stripped from SMTP incoming traffic by the firewall if it is capable, assuming you host email yourself. Furthermore, closing as many services on client computers as is possible also slows or prevents many worms from moving even after a successful compromise on a vulnerable box.

I still didnt get it, Jaz. Im with you, according to your info. VLAN Just wont work.
If they suggest to implement VLANs AND create some "zones" into your network, protecting each by firewalls, it can work.
For example, I did an implementation that server farm (Intranet) is behind some firewalls, protecting them from inside attackers.
But I cant see this kind of implementation on a small company like yours. Im not sure what kind of business are being conduced there (finance?)
maybe it better to invest on perimeter defense and internal defense, such good firewalls, antivirus, anti-trojan and related stuff.
A Vlan to prevent worm flood doesnt appear to be a right choice.

I'm the head of the WAN and data infrastructure for a mid sized enterprise network. I have about thirty sites ranging from half a dozen users (at one site) to a several thousand (four sites).

I use VLAN's everywhere.

VLAN's, properly designed and administered, are one the best tools you have for having granular control of what is happening on your network. Control broadcast/multi-cast traffic, segment different departments, etc. In fact, In almost every site, I have both L3 and L2 VLAN's in place for exactly the reasons mentioned in the last sentance. I also use tagged VLAN's on wireless WAN for point-to-multipoint connectivity and as much as I fought against the introduction of 802.11 equipment being brought into my network, I've now got roaming VLAN's established for the wireless user.

Truthfully, I'd hate to go back to not having them.

Well, we don't have much info here except for our own employee stuff - most everything else is public domain. I asked them if they did a scan from outside and was told that they weren't concerned about the outside at this point. That raised a red flag, which I tried to point out to the manager. She didn't think it was a problem.

Quote:

---

was told that they weren't concerned about the outside at this point

---

This raised a "red flag"....... I can see a whole friggin' field full of red flags, big ones waving in a stiff breeze......

They want to secure you internally from the ravages of a worm that they aren't even going to bother to see if they can stop from entering from the outside..... How friggin' stupid is that unless you are milking a sap of a client for all you can...... Unless there is other information that we are not privy to then I would say "bend over"..... You're about to be raped......

My thoughts exactly - the IS manager isn't very 'savvy', and I have no authority over the process. My head hurts...

Not concerned about the outside at this point? That's insane, I'm sorry man .. it sounds like your going to have a lot of work on your hands in the future if this is the general attitude.

With your new information and answer for your Boss (Blondie? :P ), i have only one advice:
Do it as they told you.
It doesnt appear to be a regular audit procedure.
So, you dont have ALL information about to argue.
Then, Why counterfight? It will be a good experience for you anyway. VLAN nowadays must be mastered by network admins.

VLANs can help mitigate the impact of a worm if you make use of rate-limiting and/or ACLs on the (L3)switch/router. Rate limiting allows you to assure a certain minimum amount of bandwith to each vlan (like you mentionned doing with your finance dept.) whereas the worm could easily eat everyone's bandwith otherwise; you're restrincting the scope of the potential DoS...

You could also use acls (with L3 vlans) to make sure that the diffrent depts. don't access each other's ressources (if applicable) or block certain ports (or the reverse, default deny then allow..) at the router... For example, if you're workstations don't share in a peer-to-peer fashion, there's no reason for a developpment workstation to access a finance workstation on ports 137-139, 445, whatever, etc.!

In general, vlans allow you to regroup and segment the network in assets of diffrent priority, priority, vulnerability, value, "mission criticalness", in order to reduce risk and exposure as well as (helping to) ensuring minimum network performance.

Besides, if you're using windows with filesharing with nebios on that network, take a look at how much broadcast is going on on that segment... At 180 hosts on a single segment, I'd consider it worth it even just for the broadcast domain segmentation...

Ammo

Hey Tiger, I think they've already been raped....


Dude, you need to get it into the IS manager's head how important it is to even have a basic external scan done....


You might consider finding a new job, one where you don't work for idiots?



EDIT: Tell the IS manager he caused an ID 10-T error...

May I ask why you are so worried about external threats? Have you now firewall installed yet? Are you hosting public services (www, ftp, ... )? Do you particular concerns about your perimeter's security?

As far as I'm concerned, without having the bigger picture, it might be totally reasonable to be focusing on the internal security. To many admins only worry about external attacks and don't apply defense in depth, and quite frankly, I'm surprised that so many in this thread aren't recognizing this fact right now...

Ammo

I have some experience with vLANs. Unfortunately, we didn't purchase many L3 switches - only L2 for the workstations, and 2 L3's for the servers and backbone. My biggest concern here is that we have a good bit of our fileshares on a number of different servers, with no "departmental" isolation - the only real benefit we'll have with vLAN is isolating workstation traffic from other workstations. I realize I should be most worried about internal hacks, but I'm pretty good at sniffing 'em out.

As far as a new job is concerned, I have benefits out the wazoo here - hard to match the money as well. Them chains of gold...

I'm first and foremostly worried about outside attacks at this time. I know that internal attacks are more common, but we've been able to harden most of the more obvious external spots (stateful inspection, port blocks, yadda yadda yadda), and I want to get it solid before we go to the internals. Besides, our typical user isn't very computer-savvy...unfortunately.

I agree (of course) with Ammo that many admin neglect about their duties about internal security -- a lot of theats come from inside, Vlan is the first step of countermeasures?
Maybe the company are so well secured that its the time to implement Vlan to enhance security.
But it is still (with the given information) looking that the weapon is too big for the size of the enemy...

And that's the other thing. We're pretty small, and I'm not sure if we need (or can afford) big-time solutions. We have been doing some squid stuff at the workstation level - complex password, etc. If I had my druthers (and money), I'd get some ISS equipment in here and lock that system down tighter. I did some beta for them a long long time ago and was VERY impressed at the time. Dunno what their stuff looks like nowadays.

Quote:

---

Originally posted here by Jazdaddy
I have some experience with vLANs. Unfortunately, we didn't purchase many L3 switches - only L2 for the workstations, and 2 L3's for the servers and backbone. My biggest concern here is that we have a good bit of our fileshares on a number of different servers, with no "departmental" isolation - the only real benefit we'll have with vLAN is isolating workstation traffic from other workstations. I realize I should be most worried about internal hacks, but I'm pretty good at sniffing 'em out.

---

Well, I have a similare situation at my place:
Two L3 switches (backbone/servers) and the rest are L2s, and all my servers (which serve many shares to diffrent groups) are in the same VLAN. While perhaps not ideal, I do make use of vlans to regroup workstations, but workstations on diffrent vlans can't talk to each other, only to the servers and to the gateway (internet/dmz through firewall/proxy...). The benefits are that diffrent departments are segregated; in case of a worm, it's traffic is limited at the vlan level and the server vlan, which can have filtered (ACLed) access or at a minimum, it's much easier to monitor, harden, patch a couple servers than making sure none of the other hundred-something workstations are vulnerable or that a user has unknowingly opened up an unprotected share or whatever. In effect, it's almost like firewalling (you can picture it in a true ("building") fire-wall) your internal network...


Ammo

Ya, I can see your point. Unfortunately, we do have a need to deal with workstation/workstation access, but we may be able to socially engineer that one. I've been more than willing to get more folks here trained in our systems, but we have a tight budget for training. Another thing I'm trying to work on - a well-trained employee who might leave is better than an untrained one without motivation... ;)

Make them server shares that they can control access to, convince them to use them instead of local shares by telling them amongst other things that workstation files aren't backed up while servers are (eventhough it might not be true!);

Having company files only on the servers could/should possibly be policy too: 1- for backup reasons like I just said, 2- It's much easier to steal a workstation or it's hard drive than to break into the server room and steal a server.

(Seriously, there have been cases like that recently in Quebec where the Revenue Department had computers stolen that had confidential information on their hard drive. Had that info been on the server, it would have been much less of a worry for them.)

Ammo

I'm just a great fan of VLAN implementation for the following reasons

- It limits the broadcast domain to each VLAN (let's says 20 users each) thus mitigating ARP poisoning and spoofing attacks, and optimizing bdw utilization especially for GVRP applications...

- With a single ethernet backbone infrastructure you can force flows to be routed from one VLAN to another through a router and then have a low cost DMZ capability (paranoid would says that VLAN hopping attack but it's a blindf attack & I really think that threat is very low risk).

As a peronnal opinion VLAN backone coupled with 802.1x authentication is a real layer 2 secuerd solution...

I guess my concern is still that all users will need to be on the same vLAN to access the file shares, or there will need to be a lot of routing between vLANs for users to access all of the fileshares that they have access to today. Also, can anybody tell me what impact the inter-vLAN traffic will have on the router? Thanks for your help!

Having inter-vlan routing isn't a bad thing in itself, in fact this the only place you can really control traffic with ACLs...

As for the impact on the router, well, that depends on the router... In my case, I use a Cisco catalyst 3550-24pt which when reviewed by network fusion world showed near wire-speed (almost no latency) even with vlan routing and acls enabled thanks to its ASIC.

Considering your users are accessing only a couple servers and that these are probably using 100mbps adapters (guess?) and are handling the load appropriately (guess?!), meaning that the overall traffic isn't too overwhelming, I think the added burden on the router from the increase in routing shouldn't be too great. And if you're using an L3 switch with ASIC (Application Specific Integrated Circuitry) like the Cat3550, you should really be just fine.

Ammo

We'll probably be using a 2600 - I'll look and see if I can find any info. Thanks!

Greetings:


Just a quick post to thank all of you who have been so helpful to Jazzman! His real name is Dan (sorry Dan).

He is a very good customer of mine at Iris (my resto.), and now a good friend as Rhoda and I think the world of him. (as well as my entire staff including the Giant BOOBS)

We got to talking over several drinks the 4th (estimate) time he came in to dinner, and to stare at the GIGANTIC boobs of my bartender. (hehe she is Hot though.)

We both found common ground regarding all things geeky, and he informed me he is SYS Admin. And very sharp.

I immediately encouraged him to check out AO.

After many proddings (after cruising the site he felt technically intimidated to post.)

He did so this past week and he told me tonight, as we pounded several drinks at my bar that he is glad to be a part of this forum! He has a lot to offer.

Thank you so much for helping him and creating another happy (maniacal), and valuable member.

You all make me proud!

:D


Nicolas

Quote:

---

Originally posted here by D0pp139an93r
Hey Tiger, I think they've already been raped....
Dude, you need to get it into the IS manager's head how important it is to even have a basic external scan done....
You might consider finding a new job, one where you don't work for idiots?
EDIT: Tell the IS manager he caused an ID 10-T error...

---

This is just a plain silly ass statement. Not much help or encouragment to an "AO Noob", why do think the membership of quality ppl. is dwindling?


Well I guess your attitude does reflect your ID at times......................


"Meaning "double walker" a doppelganger is a shadow-self that accompanies every human. Only the owner of a doppelganger can see it, otherwise it is invisible to human eyes. Dogs and cats have been known to see doppelgangers. Providing sympathetic company, a doppelganger almost always stands behind a person, and they cast no reflection in a mirror. They are prepared to listen and give advice to humans, either implanting ideas in their heads, or a sort of osmosis. It is said to be bad luck if it is seen, and rarely a doppelganger will make itself visible to friends or family, often causing great confusion. Doppelgangers can be mischievous and malicious."

- Source: Google

:rolleyes:

Since Ammo is dropping product names, I will too.

For the last year or so, I've been buying almost exclusively Foundry switches, and I couldn't be much happier with them. Not only in terms of performance, but with the company as well. They've been immeasurably more supportive than any of the big vendors I deal with.

Depending on the use, I've been using their FES and Fast Iron line of switches for VLAN aggregation and distribution. The FES's are stackables, in 12, 24, 48, and 96 port form factors, and I buy them with base L3 code. Reasonably priced, easy to config, and they run like scalded dogs. Check them out. Foundry Switches


--edit: To fix my link.