Solved

Possible to just filter packets on the same SUBNET?

Posted on 2004-08-19
1
233 Views
Last Modified: 2010-04-09
Hello everyone,


we run about 15 servers on one network subnet 138.240.260.0.  not physically the subnet for security reasons on experts-exchange.   this is our logical setup though!  We would like to hardware firewall 3 Servers with the ips 138.240.260.136, 138.240.260.137, 138.240.260.138.  But the IP address cannot change.  And we do not want to firewall the entire subnet so we do not effect the other servers.  What is everyone's suggestion on the question?  from what i know.  a standard firewall will need 2 different networks on the front and back side.  I've heard of a hardware device that could sit on the wire just for those 3 servers and strictly filter packets.  While still not changing subnet or ips.  It's a MUST that these IP address not change on the servers so that takes out the possiblity of NAT.  Product suggestions?  Or can we in fact do this on a standard firewall....
0
Comment
Question by:jbsengineer
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 11

Accepted Solution

by:
PennGwyn earned 125 total points
ID: 11897740
I think what you're saying is that these three servers need to see THEMSELVES at these addresses, and not just that the world needs to reach them at those addresses -- ruling out a  static NAT or port forwarding solution.

Some recent switch models, such as the Cisco 3550, can apply restrictions and/or access-lists to individual ports within a VLAN.  That could be one approach.

MOST firewall products operate as routers, and so need to be at a subnet boundary.  A few, though, can operate as transparent bridges, which solves a number of problems -- including this one.  I've been particularly impressed with solutions from Tipping Point which are built this way.  I don't know if they have a configuration that will meet both your needs and your budget, but check them out.

0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question