Virtual Router Best Practice - Guest Network

[jbusby]

Hi, 

We don't have dual ISP but we do have STS VPN that connects our offices to our Cloud Infrastructure.  At the moment all the interfaces share the same virtual router. So assuming the traffic from source to destination was allowed in a security policy then it will be able to route to the remote subnets via the STS VPN interface. 

We have separate Zones and Virtual Sub interfaces for our different VLANs , I was thinking as an additional measure if it would make sense to attach our Guest network (that only requires limited access to the internet and nothing else) to a separate virtual router that doesn't know about these routes.

I was thinking in the event of a misconfiguration of security policy assuming it passed through the various change controls (hypothetical) then undesired traffic still wouldn't be able to reach the remote cloud infrastructure. 

Does this line of thinking make any sense or is it unnecessary complexity?

Thanks! 

[seb_rupik · Accepted solution]

Hi there,

In the distant past of my career when I was configuring campus wireless, what you are describing is the cornerstone of a wireless guest anchor controller design. The notion of moving truly untrusted guest traffic away from corporate traffic is sound security practice. If budget allowed you would place this traffic on separate equipment and it would only 'join' the corporate traffic on the WAN edge routers. When it is not possible to physically separate the traffic then using VRFs is an acceptable substitute for most deployments.

cheers,

Seb.