topic 2960X - WAN and DMZ on same switch separated by vlans? in Advanced Threat Prevention Discussions

2960X - WAN and DMZ on same switch separated by vlans?

Joshua2215 — Thu, 02 Dec 2021 00:34:56 GMT

the title says it pretty much. Trying to consolidate a 24 port switch that only uses 3 ports with another 24 port that is only using 2 ports.

How safe/comfortable would you be if you used the same switch for DMZ and WAN traffic, but separate them by VLAN, and strict access trunks to a firewall?

Re: 2960X - WAN and DMZ on same switch separated by vlans?

SureshReddyM — Sat, 06 Mar 2021 15:47:57 GMT

Hi,

It's always strongly recommended to use different layer 2/layer3 switches for WAN links and DMZ servers connectivity.

Best Regards,

Suresh

Re: 2960X - WAN and DMZ on same switch separated by vlans?

SureshReddyM — Sun, 07 Mar 2021 16:42:36 GMT

Hi,

It's not about how many ports are using or not using. It's about security. How much security you are providing for your server or servers in DMZ and your wan interfaces are entry for all your outside (untrust ) traffic enter point ie inbound traffic. There are couple chances that attackers can initiate DOS or DDOS /flooding mechanism like syn and ip etc and also there is chance that ip spoofing or Mac spoofing or any one of above will down your network interface and it's tough to troubleshoot when even you get an issue or traffic issue. And also think about redudnacy solution all wan and DMZ are dependent on same switch also loop hole in design.

That's a reason I recommend to use two different or staked redudnat switches towards both links.

Best Regards,

Suresh