Cisco VLAN: DMZ VLAN and SAN VLAN shared on a pair of 3750G switches

Cisco VLAN Masters:

I'm trying to cut corners and save a few bucks. I'd like your comments. Currently we don't have a DMZ or SAN. In the near future we will. I wanted a pair of small 12 port Cisco Catalyst Gigabit switches for the DMZ and another for the SAN, but didn't see any that exist. So i'm considering a pair of 24 port 3750 Gigabit switches then separarting the DMZ and SAN via VLANs.

What are the pros and cons and your opinions of using one pair of 3750 switches for the DMZ and SAN then separting the two via VLANs?  If you have other options I'd like your input.

Thanks.
LVL 1
First LastAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

First LastAuthor Commented:
I did come across this acticle: http://seclists.org/firewall-wizards/1998/Aug/203

Seems to be seveal good reasons why to use a different pair of switches for the SAN and DMZ.

What does everyone do in their environment?
0
btassureCommented:
Ignore that. It's perfectly fine to use a VLAN for your DMZ. The only caveats I would suggest are: change your native VLAN so that traffic cannot be spoofed onto it and to not give that VLAN a VLAN interface. That will stop traffic from being routed between VLANs on that switch. Using a pair of 3750Gs means that you can then stack the switches and get yourself a bit of redundancy (you would need to connect all your servers to both switches at once so you may not want to bother). We run everything on a single 6509 switch and just have it locked down so traffic cannot be spoofed through. It's also a case of risk analysis - if someone has compromised your DMZ server the network itself is probably not the weakest point for them to attack from there so just secure it as far as is sensible.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
First LastAuthor Commented:
Thank you for giving me reasons to run a DMZ and SAN on the same pair of switches. I'm going to bring it up today. The best case is I'm given money for two pairs of switches; one for the san and one for the dmz. Else, i'll use one set for both.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.