From owner-freebsd-security Fri Aug 20 22:17:54 1999 Delivered-To: freebsd-security@freebsd.org Received: from mail.xmission.com (mail.xmission.com [198.60.22.22]) by hub.freebsd.org (Postfix) with ESMTP id 62D461543B for ; Fri, 20 Aug 1999 22:17:49 -0700 (PDT) (envelope-from wes@softweyr.com) Received: from [204.68.178.39] (helo=softweyr.com) by mail.xmission.com with esmtp (Exim 2.12 #1) id 11I3XI-0002uT-00; Fri, 20 Aug 1999 23:17:48 -0600 Message-ID: <37BE367A.C6FB893C@softweyr.com> Date: Fri, 20 Aug 1999 23:17:46 -0600 From: Wes Peters Organization: Softweyr LLC X-Mailer: Mozilla 4.5 [en] (X11; U; FreeBSD 3.1-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: "Rodney W. Grimes" Cc: jay d , Evren Yurtesen , freebsd-security@FreeBSD.ORG Subject: Re: multiple machines in the same network References: <199908210027.RAA25131@gndrsh.dnsmgr.net> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org "Rodney W. Grimes" wrote: > > I already said to put the switch on it's own router port with full > and correct filtering. I see a lot of people replying to ``put them > on thier own segment''. Now I am not sure if they mean put each individule > customer on there own segment, or to lump them all togeather on one segment. > My model was to put them all on one switch, with that whole segment of > the network seperated and protocted in both directions from any of the > ISP's and Internet stuff via a router with filtering capability. Putting > 2 customers on any one segment is always a bad idea, it allows either > to compromise the other easily by simple tcpdump style sniffing. > > The customer per router port is probably the most secure model, even > more secure than a VLAN switch and single filtered router port, it is > also the most expensive model. Ah hell, just buy a switch/router and get the whole mess in one box. If you buy the RIGHT one, you can get your wide area/internet link AND your firewall all in the same box. Anyone who thinks a router provides more security than a VLAN switch doesn't understand how VLANs work. -- "Where am I, and what am I doing in this handbasket?" Wes Peters Softweyr LLC http://softweyr.com/ wes@softweyr.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message