Multiple domain question.

[rusty155]

Hello all!

 

I have two physically separate domains for Admin and curriculum here. For the most part this is fine until SLT start demanding resources from both networks. The immediate problem I have is that We have a CCTV server on our Admin domain, which the SLT gain access to via a software client on their Admin workstations.

 

They would like to enable access to the CCTV from one machine on the curriculum domain in a staff member's office. This office is located in an area of the school where we do not currently have access to admin switches and so can't simply put two NIC's in the Curriculum workstation. Is there a way that I can put a software-based firewall such as Smoothwall between the two networks and allow access to the CCTV server?

 

Longer term I would also like to set up a one-way trust relationship between the domains so that Admin staff and SLT can access curriculum resources. I am not sure however what I need between the two networks in order to do this. Both domains are completely different subnets and i am not sure what i need to do the job - router or firewall or both?

 

Any help would be greatly appreciated.

[Geoff]

Yes. you can put a firewall between these two networks and route traffic on a per host/port/whatever basis. I'm unsure if Smoothwall will do this out of the box, but the underlying Linux OS is perfectly capable of doing the job.

[rusty155]

Fantastic! Can you perhaps recommend a linux distro and/or point me in the right direction of how to set it all up?

 

Thanks.

[Geoff]

I use Ubuntu 6.06 LTS Server Edition here.

 

http://releases.ubuntu.com/6.06/

 

I use Shoreline to simplify the setup of the firewall/routing.

 

http://www.shorewall.net/

 

The '3 interface' setup guide will be sufficient for you.

 

http://www.shorewall.net/three-interface.htm

[rusty155]

Thanks very much - i'll look into it!

[MrDarcy]

Just to take a completely different tack: if all you want is to run one Admin PC off a Curriculum switch you could try VLANs (if you have managed switches! - or can swap one into that cabinet)

 

I had one cabinet that until recently had only Curriculum links, but now needed a couple of Admin points. Set up two VLANs on the switch, ports 1-20 for Curriculum on VLAN 1, ports 21-24 for Admin on VLAN 2, configure the Uplink to VLAN 1 - Untagged, VLAN 2 Tagged (with the same at the other end of the Uplink) and we have Admin connections sharing the 'Curriculum' link.

 

Geoff, is there anything to know about setting up the Trust relationship? What if you have two domains that were set up independently and have never been 'related' to each other, does that matter?

[ajbritton]

You can happily set up trust relationships between domains that are not 'related', provide their are no clashes in server names, domain names etc.