Learn the most important control and control categories that every architect and developer should include in their projects.
Network Architecture
12K
Solutions
11K
Contributors
Network design and methodology, also known as network architecture, is the design of a communication network. It is a framework for the specification of a network's physical components and their functional organization and configuration, its operational principles and procedures, as well as data formats used in its operation. In telecommunication, the specification of a network architecture may also include a detailed description of products and services delivered via a communications network, as well as detailed rate and billing structures under which services are compensated.
Share tech news, updates, or what's on your mind.
Bootstrap 4: Exploring New Features
Learn how to use and navigate the new features included in Bootstrap 4, the most popular HTML, CSS, and JavaScript framework for developing responsive, mobile-first websites.
I'd like some design input regarding how best to peel off (and secure) traffic from a carrier network interface device (NID) providing both Internet and MPLS connectivity over a single pipe.
The carrier is providing a single circuit carrying both Internet and private data (MPLS backend) via different VLAN tags (let's say Internet=X, MPLS=Y) to a carrier-managed NID. There will be a pair of firewalls to handle the Internet traffic, so a pair of switches will be in front of them. Here's an overall simplified version of the scenario:
We’ll obviously extend the VLAN X from the switches to the firewalls, but I’m trying to determine the best way to handle the VLAN Y private traffic. I’ve recently seen a design where the customer had this external switch with a separate couple connections for the private VLAN directly to the core environment (so, bypassing the firewalls). Obviously, this is not wise, as these switches have a public IP, and compromise for them would provide access to the core directly.
So, the two options would seem to be 1) also trunk data VLAN (Y) over the same connection to the firewall, and then use them somehow to provide a layer of security/abstraction from the outside world, or 2) implement another layer of something off of these switches to do the same.
How are others handling enterprise Internet/WAN when these services are delivered over a single circuit?
I’m not afraid of reading, so reference links/resources would …
The carrier is providing a single circuit carrying both Internet and private data (MPLS backend) via different VLAN tags (let's say Internet=X, MPLS=Y) to a carrier-managed NID. There will be a pair of firewalls to handle the Internet traffic, so a pair of switches will be in front of them. Here's an overall simplified version of the scenario:
We’ll obviously extend the VLAN X from the switches to the firewalls, but I’m trying to determine the best way to handle the VLAN Y private traffic. I’ve recently seen a design where the customer had this external switch with a separate couple connections for the private VLAN directly to the core environment (so, bypassing the firewalls). Obviously, this is not wise, as these switches have a public IP, and compromise for them would provide access to the core directly.
So, the two options would seem to be 1) also trunk data VLAN (Y) over the same connection to the firewall, and then use them somehow to provide a layer of security/abstraction from the outside world, or 2) implement another layer of something off of these switches to do the same.
How are others handling enterprise Internet/WAN when these services are delivered over a single circuit?
I’m not afraid of reading, so reference links/resources would …
Become a Certified Penetration Testing Engineer
This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.
Network Architecture
12K
Solutions
11K
Contributors
Network design and methodology, also known as network architecture, is the design of a communication network. It is a framework for the specification of a network's physical components and their functional organization and configuration, its operational principles and procedures, as well as data formats used in its operation. In telecommunication, the specification of a network architecture may also include a detailed description of products and services delivered via a communications network, as well as detailed rate and billing structures under which services are compensated.
Top Experts In
Network Architecture
-
1
CompProbSolv6,500 points -
2
noci5,600 points -
3
Pete Long2,800 points -
4
Dr. Klahn2,650 points -
5
Kimputer2,600 points -
6
skullnobrains2,550 points -
7
atlas_shuddered2,550 points -
8
John2,300 points -
9
pcelba750 points -
10
Dirk Mare640 points -
11
kevinhsieh550 points -
12
Olaf Doschke550 points -
13
MLV CM300 points
-
14
Sanga Collins150 points -
15
Stuart Scott148 points -
16
David Johnson, CD, MVP50 points -
17
Abraham Deutsch50 points -
18
Scot Halvorsen42 points -
19
Akinsd37 points -
20
Santosh Salunke34 points -
21
Blue Street Tech28 points -
22
Shakshi Shivi21 points -
23
Ray Paseur18 points -
24
irom7717 points -
25
Dave Greenfield, Cato Networks14 points