• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 237
  • Last Modified:

Possible to just filter packets on the same SUBNET?

Hello everyone,


we run about 15 servers on one network subnet 138.240.260.0.  not physically the subnet for security reasons on experts-exchange.   this is our logical setup though!  We would like to hardware firewall 3 Servers with the ips 138.240.260.136, 138.240.260.137, 138.240.260.138.  But the IP address cannot change.  And we do not want to firewall the entire subnet so we do not effect the other servers.  What is everyone's suggestion on the question?  from what i know.  a standard firewall will need 2 different networks on the front and back side.  I've heard of a hardware device that could sit on the wire just for those 3 servers and strictly filter packets.  While still not changing subnet or ips.  It's a MUST that these IP address not change on the servers so that takes out the possiblity of NAT.  Product suggestions?  Or can we in fact do this on a standard firewall....
0
jbsengineer
Asked:
jbsengineer
1 Solution
 
PennGwynCommented:
I think what you're saying is that these three servers need to see THEMSELVES at these addresses, and not just that the world needs to reach them at those addresses -- ruling out a  static NAT or port forwarding solution.

Some recent switch models, such as the Cisco 3550, can apply restrictions and/or access-lists to individual ports within a VLAN.  That could be one approach.

MOST firewall products operate as routers, and so need to be at a subnet boundary.  A few, though, can operate as transparent bridges, which solves a number of problems -- including this one.  I've been particularly impressed with solutions from Tipping Point which are built this way.  I don't know if they have a configuration that will meet both your needs and your budget, but check them out.

0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

Tackle projects and never again get stuck behind a technical roadblock.
Join Now