Virtual Router Best Practice - Guest Network

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Virtual Router Best Practice - Guest Network

L1 Bithead

Hi, 

 

We don't have dual ISP but we do have STS VPN that connects our offices to our Cloud Infrastructure.  At the moment all the interfaces share the same virtual router. So assuming the traffic from source to destination was allowed in a security policy then it will be able to route to the remote subnets via the STS VPN interface. 

 

We have separate Zones and Virtual Sub interfaces for our different VLANs , I was thinking as an additional measure if it would make sense to attach our Guest network (that only requires limited access to the internet and nothing else) to a separate virtual router that doesn't know about these routes.

 

I was thinking in the event of a misconfiguration of security policy assuming it passed through the various change controls (hypothetical) then undesired traffic still wouldn't be able to reach the remote cloud infrastructure. 

 

Does this line of thinking make any sense or is it unnecessary complexity?

 

Thanks! 

1 accepted solution

Accepted Solutions

L4 Transporter

Hi there,

In the distant past of my career when I was configuring campus wireless, what you are describing is the cornerstone of a wireless guest anchor controller design. The notion of moving truly untrusted guest traffic away from corporate traffic is sound security practice. If budget allowed you would place this traffic on separate equipment and it would only 'join' the corporate traffic on the WAN edge routers. When it is not possible to physically separate the traffic then using VRFs is an acceptable substitute for most deployments.

 

cheers,

Seb.

View solution in original post

1 REPLY 1

L4 Transporter

Hi there,

In the distant past of my career when I was configuring campus wireless, what you are describing is the cornerstone of a wireless guest anchor controller design. The notion of moving truly untrusted guest traffic away from corporate traffic is sound security practice. If budget allowed you would place this traffic on separate equipment and it would only 'join' the corporate traffic on the WAN edge routers. When it is not possible to physically separate the traffic then using VRFs is an acceptable substitute for most deployments.

 

cheers,

Seb.

  • 1 accepted solution
  • 279 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!