Design Request - Split Current Network in Two

You may wish to investigate the Cisco Solution Designer:

Brad Reese BradReese.Com Cisco Repair Service Experts

Email me at jschwefel at copesan dot com. I think I could give you hand with this. (work email, will be in on monday)

There are a variety of solutions that, depending on specifics such as current carrier(s), specifically how you have you VPN connection set up, you can explore.

Recently went through a similar exercise for one of my Clients (a retail chain with HIPAA requirements that needed to support third party systems at their stores). We used a PIX 501 at each retail location to provide a second, physically independent LAN for the untrusted devices; a separate, physically independent LAN at the HQ for untrusted servers; and VPNs from the HQ PIX for remote access by third parties. To prevent a configuration nightmare, the individual store PIXes have a simple security policy: traffic coming from the untrusted store LAN to the trusted store LAN must have 1 - a valid source address identifying the source as on that store's untrusted LAN, and 2 - a destination address that is either on the untrusted core LAN or that would always be routed through a core firewall. That way, as third parties come and go, we only have to adjust the core router access lists (for the untrusted core LAN) and core PIX access lists (for VPNs and other Internet access).

To protect the store network from denial of service attacks, traffic shaping is used on all routers to limit the third party aggregate to at most 50% of the T1 servicing each store. Further limits are placed on backup links so that high profit, low traffic third parties like ATM machines can continue operation even when a store is on dial backup while high bandwidth operations like photo processing are put on hold. Getting this part to work was a real bear, as every IOS release, every Cisco hardware platform, and every interface type seems to support different traffic shaping capabilities, non-trivial when working with point-to-point T1, MLPPP and single B channel ISDN, and analog (POTS or cellphone) using the AUX port. (Yes Virginia, retail clients do not like to stop selling. When the world trade center came down, the only stores which lost communications were those that lost all power, and the only store which was not back in operation when the power came back on was the branch in the WTC.)

As you put together your solution, keep in mind how it will operate when failures occur, and how you will maintain it over time. If you need some serious help, feel free to contact me directly to arrange consulting help. If you just want to bounce your ideas off of someone who has "been there, done that" feel free to post them here. I (and many others) are always willing to provide free advice in the form of quick responses to public usenet postings.

Good luck and have fun!

Americana. "Yes, Virginia, there is a Santa Claus" was the original phrase... to see the original context, any good search engine should be able to find it.

In article , snipped-for-privacy@X31.networkingunlimited.com says... [cut off]

Vincent, if it is not a secret, who is Virginia? You mentioned her here a few times....

Hm.. I knew that american opsession with Santa Clause has to come up to the surface, sooner or later.

Thanks all for the info -- this give me some good leads to investigate.

Thats ridiculous. Just get a bandwidth manager, create a NAT for the customers, and shape their traffic to whatever you're comfortable giving them. Its about a $2500. solution; they'll pay you more than that to implement something else. You can also shape each IP, so one bozo in the store can't eat up all the bandwidth. Its a must for small operations.

Tommy

In article , wrote: :Thats ridiculous. Just get a bandwidth manager, create a NAT for the :customers, and shape their traffic to whatever you're comfortable :giving them.

Unfortunately you posted without indicating context. If you had indicated context, you would have seen that your proposed solution does not meet the design goals.

The OP's foremost concern is not *bandwidth*, but rather *security*. He doesn't want the additional hosts to be able to infect his internal hosts, so he does need some kind of filtering between the additional hosts and his network. That filtering can be done via a firewall or via the Firewall Feature Set on an IOS router (or "Advanced IP Security" or whatever they renamed Firewall Feature Set to.)