How to/what needed

[ImBurrMan]

Hello, please bare with me and my lack of knowledge.

I have an SA 500 with the optional port configued as the DMZ. The LAN ports are running the 192 range and the DMZ is the 172 range.

I have seperate offices (A few hundred feet apart) that have been connected  with 2 unmanaged switches uplinked with a single wire. The 192 range stuff runs over this. I need to get the DMZ out to the second room and was asking about how to do this over the single uplink and switches. (Trying not to run a second wire)

My lack of understanding had me draw up this diagram attached as a picture, to ask about. What it shows is me trying to get the DMZ through the uplinked switches to the other room. I thought of using 2 routers, one on each end. I've been told this is incorrect and wont work.

Maybe a purchase of a second hardware and eliminate the switches? (uplink the SA 500 to another device?) What should that device be?

I would appreciate any comment on this. Thanks, Burr            

[ImBurrMan]

As an added note. please dumb down the answers. Limited experience and understanding here....

[Elton Babcock]

Are the switches manageable? If so what kind are they.



Sent from Cisco Technical Support iPhone App

[ImBurrMan]

No, they are unmanaged switches. Ones just an 8 port linksys and the other is a Dell connect, unmanaged. Just plain switches.

[ImBurrMan]

Beuller? Beuller????

[Elton Babcock]

Well I can give you a solution using these switches but I can't say it's secure or recommended at all.

You can pass both subnets on these switches due to the way switching works. You can connect multiple subnets into a switch and it will pass the traffic only to the hosts in the same subnet due to the way ARP works.

Not very secure especially that one of your subnets is a DMZ. Also with this design all hosts are still in the same broadcast domain with isn't ideal.

It might be worth purchasing some cheap 2950 switches on EBAY to allow for Vlan trunking and segregation on the switches.

Elton

Sent from Cisco Technical Support iPhone App

[ImBurrMan]

Yeah, not going to go with unsecure, "not recommended". I looked on ebay at the 2950 switchs. Seems to be a mass of really cheap stuff. There must be a reason?

Are there any Cisco Reps here that chime in for the advice?

It's just a small business so i dont need to be spending 10,000 on switches. Looks like Vlans is the option.

So I suppose I would need 2 switches that will do the vlan config? (I looked at the Dell PowerConnect 3524 Switch)

Then I suppose I may ask what that would look like (I'll have to study up on vlans) Just plug the dmz and the lan ports into the switch and it securly controls the flow over to the other switch?

Anyway, thanks for chiming in Elton!

Burr

[Elton Babcock]

The reason that the 2950s are cheap is they are soon end of support from Cisco and fairly old. However they are still very capable for small business and have plenty of features. The 2960 and 2960S series can be purchased new and are the new models from the 2950s.

Any switch that is manageable and do VLANs is ideal in my opinion. The other thing that should be considered is some sort of firewall solution. Whether it be on your current Cisco router or a separate device. You can get some Juniper Netscreen 5GT firewalls cheap on EBAY as well.

Also there are plenty of capable people on her that are very willing to help you with configuration and design. Myself included.

Elton

Sent from Cisco Technical Support iPhone App

[ImBurrMan]

Thanks Elton,

    Yeah, the SA 500 is our firewall device. Controlling a VPN. Internally, I just need to get the DMZ up to the other room without running another wire (running another wire is optimal, just less optional).

I didnt originally care for the juniper stuff I looked at, thats why we got the SA 500. But not opposed to it now.

Elton Babcock wrote:
    Any switch that is manageable and do VLANs is ideal in my opinion.

Yeah, that sounds like it. I just need to start the research on what all that means, why and how, so i buy the best option for us.

Maybe someone that knows the SA 500 and looks at what i am trying to do can suggest the 2 switches from Cisco?

I suppose the real roadblock for me is if the suggestion is 2 x 2000 dollar switches.

Maybe just 1 more SA 500 on the other end, and uplink those? Then just expand the lan with the switches from those?

[Elton Babcock]

As for the question about how VLANs can be security transferred to another switch over the same cable is through 802.11q tagging.

The switch basically adds tags to the packet and the downstream switch is configured to read those tags and forward them onto the appropriate VLAN.

This only happens on what are called trunk ports.

Elton

Sent from Cisco Technical Support iPhone App

[ImBurrMan]

Elton Babcock wrote:
As for the question about how VLANs can be security transferred to another switch over the same cable is through 802.11q tagging.

The switch basically adds tags to the packet and the downstream switch is configured to read those tags and forward them onto the appropriate VLAN.

This only happens on what are called trunk ports.

Very cool. I'll read on those tonight. Probably browse through the SA 500 docs on it's Vlan capabilites to see if that sheds light also.

Thanks Elton

[Elton Babcock]

I'm not familiar with the SA 500 but I assume you have a cable running to a switch for your LAN and a cable running to a switch for your DMZ right?



Sent from Cisco Technical Support iPhone App

[ImBurrMan]

Yes, thats it:

You can configure the "optional port" to be the DMZ and it will create the seperate "172 range" internal network, which is unfiltered and unsecure, and pump everything out the WAN port. It will do the vlan stuff. Again, i just need some study and understanding.

So I need to run the optional port and the LAN prts to the other room over a single wire, maintaiing the seperation and security of the 192 and 172 lan configs.

Still dont know how to configure the SA500 well for Vlans. Reading and maybe a couple questions.

[Elton Babcock · Accepted solution]

I would say you really wouldn't need to configure VLANs on the SA 500. The subnets are separated already within that device.

I would run a cable from a LAN port to a managed switch port configured as an access port for a specific VLAN. Then run a cable from the optional port the the same switch but to an access port configured for a different VLAN.

Then you configure a trunk port to connect to your remote switch that will carry both of those VLANs on the same wire.

Any machines in the other room will plug into access ports in their respective VLAN.

Elton

Sent from Cisco Technical Support iPhone App

[ImBurrMan]

That sounds like it Elton. So I need "2 managed switches" capable of doing vlans.

You directed me to "Cisco 2950 switches" which are pretty cheap on ebay. Noting that the SA500 is roughly a $500.00 device, what would be some switches from Cisco i should look at? You mentioned the "The 2960 and 2960S series" and I havnt looked at those yet, but intended to a little later. The Dell (Juniper?) ones are around 299.00.

Thanks again Elton. You're getting me on the track I need to be!