Cisco VLAN: DMZ VLAN and SAN VLAN shared on a pair of 3750G switches

Cisco VLAN Masters:

I'm trying to cut corners and save a few bucks. I'd like your comments. Currently we don't have a DMZ or SAN. In the near future we will. I wanted a pair of small 12 port Cisco Catalyst Gigabit switches for the DMZ and another for the SAN, but didn't see any that exist. So i'm considering a pair of 24 port 3750 Gigabit switches then separarting the DMZ and SAN via VLANs.

What are the pros and cons and your opinions of using one pair of 3750 switches for the DMZ and SAN then separting the two via VLANs?  If you have other options I'd like your input.

Thanks.
LVL 1
First LastAsked:
Who is Participating?
 
btassureConnect With a Mentor Commented:
Ignore that. It's perfectly fine to use a VLAN for your DMZ. The only caveats I would suggest are: change your native VLAN so that traffic cannot be spoofed onto it and to not give that VLAN a VLAN interface. That will stop traffic from being routed between VLANs on that switch. Using a pair of 3750Gs means that you can then stack the switches and get yourself a bit of redundancy (you would need to connect all your servers to both switches at once so you may not want to bother). We run everything on a single 6509 switch and just have it locked down so traffic cannot be spoofed through. It's also a case of risk analysis - if someone has compromised your DMZ server the network itself is probably not the weakest point for them to attack from there so just secure it as far as is sensible.
0
 
First LastAuthor Commented:
I did come across this acticle: http://seclists.org/firewall-wizards/1998/Aug/203

Seems to be seveal good reasons why to use a different pair of switches for the SAN and DMZ.

What does everyone do in their environment?
0
 
First LastAuthor Commented:
Thank you for giving me reasons to run a DMZ and SAN on the same pair of switches. I'm going to bring it up today. The best case is I'm given money for two pairs of switches; one for the san and one for the dmz. Else, i'll use one set for both.
0
All Courses

From novice to tech pro — start learning today.