Separating traffic in Office

Hi, we have a Comcast SMC router which is connected to our ASA firewall and behind that is a Cisco 3550 48 Port Switch. Now in our office, we have some additional tenants who lease space and our plugged into our 3550. I want to keep them off of our LAN. How can i separate their traffic efficiently? Can i plug in another router behind the Comcast router (it has multiple interfaces and we have a block of public ips) and then assign them to different vlan?
LVL 4
Cobra25Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

koudryCommented:
One approach would be to have users grouped under VLANs and you can assign the ports accordingly. If you want different security rules depending on the user groups, you can also use the zone element of the ASA to isolate the various group. You can then redirect users to certain interfaces on the ASA device and define rules for the give zones. Just a thought.
0
Cobra25Author Commented:
Yes i was thinking about the design with the separate VLANs, now if i assign their port to a certain VLAN, would i then need a cisco router (as their gateway) plugged into the Cisco 3550 switch?
0
Fred MarshallPrincipalCommented:
Yes, you can do it with a simple router as you suggested originally.
Multiple-Subnets-with-Central-Sw.pdf
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

lrmooreCommented:
What version ASA? If it is 5510, then you have ability to setup VLAN's on the 3550 switch and trunk to the ASA, then create sub-interfaces on the ASA to make virtual networks for each of the internal "customers"
If it is ASA 5505, you may need a license upgrade to trunk, or use physical interfaces for "dmz" network. Basically you want this additional network to be a DMZ with no access to your internal network, nor do you want your internal network to access theirs.
Long winded, I know, but yes, you can attach a separate router/firewall to the SMC and the switch with 2 different vlan's on the switch.
0
ArneLoviusCommented:
Although you could do it with a router and have ACLs on the router, I would suggest having VLANS terminate on the ASA as this would usually be a simpler configuration.

0
Cobra25Author Commented:
Unfortunately I have the ASA5505 with base license.

Would a linksys wireless router be able to be the gateway for the new vlan?
0
Fred MarshallPrincipalCommented:
Sure.  That was the point of the paper I sent you.  But I don't think I'd necessarily call it a VLAN unless that's what it is.  I'd call it a subnet for sure and then maybe a VLAN if you set it up that way in the ASA.  But the latter isn't necessary.
0
ArneLoviusCommented:
if your 3550 has L3 capabilities, then you could segment your network using VLANS on the 3550 and use access control lists on the VLANS to restrict traffic.

If you could post a copy of the config of the 3550 it would be useful
0
Cobra25Author Commented:
Fmarshall, thanks for that pdf. So i plan on putting the other tenants on ports 35-45 on the 3550 which the ports designated for vlan 121. On port 46 i will connect the Linksys router assigned to vlan 121. For the router, the WAN gateway would my Cisco Asa inside address right?
0
TheBadKarmaCommented:
Why not plug in a switch or hub directly into the Comcast modem and connect the other office's network? This would solve the problem AND you wouldn't need to change any configurations on your ASA or add VLAN tags on all the ports. I would keep it simple and would want to keep them as far off my network as and with as little work on my part as possible. Your network would also be protected behind the ASA AND with none of their traffic passing through your internal network.

If they have a virus infection, are you responsible for the cleaning of the infection, not to mention the added risk and resulting work of your computers being infected.  
0
Cobra25Author Commented:
I would love to do that, but based on the location of the patch panel they do not want to do this.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.