kennysarmy Posted April 21, 2015 Posted April 21, 2015 Our Head of IT wishes to set up a small network separate from the main domain! It will comprise of : 1 x server 1 x switch 4 x clients Has anyone done anything similar? Anything to watch out for? They will manage and set it up themselves, I'm not convinced they even need a "server", would a decent spec'd up workstation not be OK?
JB7 Posted April 21, 2015 Posted April 21, 2015 Has Head of IT stated why it needs to be separate from the main domain ?
Steve21 Posted April 21, 2015 Posted April 21, 2015 We use old machines from the network for Computer Science to play/install offline. Wouldn't trust "servers" though, as all they need to do is start plugging DHCP/DNS into network and games begin haha Steve
Boredguy Posted April 21, 2015 Posted April 21, 2015 Depending on course requirements, would a virtual machine not do them? I would imagine they are teaching proper networking, but if I had to provide it, it would be completely vLan'd off from everything else... right down to preconfiguring the switch they had.
kennysarmy Posted April 21, 2015 Author Posted April 21, 2015 Has Head of IT stated why it needs to be separate from the main domain ? Yes, I'm looking to extend the teaching and learning of networks and hardware because of the interest shown by students I am proposing we set up a small isolated network to teach students interested in pursuing careers in network security, networking and testing where they can be taught how to admin and use a small network and the problems and issues that come with this. It would be small groups of trusted students as per Minecraft and 3DP.
3s-gtech Posted April 21, 2015 Posted April 21, 2015 We have done similar using Virtualbox on a server, where the VMs can be set to communicate with an isolated virtual switch, if needed (they're standalone otherwise). The students get full admin on their own VM, which can be deleted and re-created very quickly. They don't get hardware experience this way, but the software and networking part is fulfilled.
kennysarmy Posted April 21, 2015 Author Posted April 21, 2015 They already have VM's for their coding element of work - we've used Oracle Virtual Box. I think the Head of IT actually wants them getting involved with DHCP, DNS etc....
Davit2005 Posted April 21, 2015 Posted April 21, 2015 Personally if they are having and want physical server with DNS, DHCP etc then how about a separate room completely isolated from main network, no sockets in the room connected to the main network at all. But you can set up a completely isolated network in Virtual box. I have done similar having a windows client, server running AD/DHCP/DNS and a firewall which provided the NAT to an outside network all in Virtual box.
harriuk Posted April 21, 2015 Posted April 21, 2015 (edited) Hi yes. I have done this. We have one of our ICT rooms kitted out with two networks. One for school and one for btec networking. These sockets go into different vlans on a switch. Each PC has two network cards one for the school network and one for the btec networking. The clever bit happens in the switch the school network nic is mac locked so only that nic can connect, so if they plug the btec networking nic in the school network port it shuts down. The btec networking nic is the only one allocated to virtualbox and will only work in the btec networking socket. The way we handled the server was to get the server set up for AD DNS and DHCP connected in the classroom under strict supervision. Once it was set up we moved it into the cupboard in the classroom and only allowed remote access to it on the btec networking network. This server was also used as a proxy server and was connected to a totally separate SWGfL connection directly into the border router. So in affect the btec networking network was completely isolated from our internal network. Hope that helps. Edited April 21, 2015 by harriuk
kennysarmy Posted April 22, 2015 Author Posted April 22, 2015 Hi yes. I have done this. We have one of our ICT rooms kitted out with two networks. One for school and one for btec networking. These sockets go into different vlans on a switch. Each PC has two network cards one for the school network and one for the btec networking. The clever bit happens in the switch the school network nic is mac locked so only that nic can connect, so if they plug the btec networking nic in the school network port it shuts down. The btec networking nic is the only one allocated to virtualbox and will only work in the btec networking socket. The way we handled the server was to get the server set up for AD DNS and DHCP connected in the classroom under strict supervision. Once it was set up we moved it into the cupboard in the classroom and only allowed remote access to it on the btec networking network. This server was also used as a proxy server and was connected to a totally separate SWGfL connection directly into the border router. So in affect the btec networking network was completely isolated from our internal network. Hope that helps. Clever..... I need to speak again with the Head of IT - but I believe he is imagining a physical server the students can actually sit in front of and trash, with some sort of Ghost or other image so it can be recovered each time they break it.... He may only be talking about a handful of students who have an interest that will get to "play" this way....
harriuk Posted April 22, 2015 Posted April 22, 2015 Clever..... I need to speak again with the Head of IT - but I believe he is imagining a physical server the students can actually sit in front of and trash, with some sort of Ghost or other image so it can be recovered each time they break it.... He may only be talking about a handful of students who have an interest that will get to "play" this way.... Yes that's what i meant you can get the students to set up the server how they want it under strict supervision, let them trash it a few times but once it is completely set up how it's needed, lock it in a cupboard and only allow remote access.
Oaktech Posted April 22, 2015 Posted April 22, 2015 I've done this once upon a time - It was a while ago, but it was done in a totally separate environment, no way to connect to the main network and internet provided by our old 10mb backup adsl line. Lasted about 2 terms before the kids involved got bored/left the school, I wouldn't spend much on it!
kennysarmy Posted April 22, 2015 Author Posted April 22, 2015 I've done this once upon a time - It was a while ago, but it was done in a totally separate environment, no way to connect to the main network and internet provided by our old 10mb backup adsl line. Lasted about 2 terms before the kids involved got bored/left the school, I wouldn't spend much on it! No way to connect to the main network because there were no network sockets in close proximity?
Oaktech Posted April 22, 2015 Posted April 22, 2015 No way to connect to the main network because there were no network sockets in close proximity? Nope... One room, one set of sockets back to one cabinet with an HP microserver and a switch in it, with one copper link to next door and the old backup adsl router.
kennysarmy Posted April 22, 2015 Author Posted April 22, 2015 Nope... One room, one set of sockets back to one cabinet with an HP microserver and a switch in it, with one copper link to next door and the old backup adsl router. What would be the REAL risk of them plugging the test network in to the LIVE one? Any worse than a kid bringing in their laptop?
mjk Posted April 22, 2015 Posted April 22, 2015 vlan and a firewall should sort any problems fairly easily.
Davit2005 Posted April 22, 2015 Posted April 22, 2015 What would be the REAL risk of them plugging the test network in to the LIVE one? Any worse than a kid bringing in their laptop? Correct me if I'm wrong but without anything in place and with everything on one vlan, there will be 2 DHCP servers one giving out IP and DNS settings for your main network and the other giving out DHCP addresses for the test network. The effect will be less if you had seperate vlans i.e. end devices seperate to server vlan. Active Directory relies heavily on DNS. And probably calls from users who say they can't log in. 1
Oaktech Posted April 22, 2015 Posted April 22, 2015 I'm not saying my way is right, but it just worked out that the layout of our building lend themselves to doing it the way I've described and simplifying things to the extreme. I would have been equally comfortable setting something up with a mac based acls in the switch and vlans.
kennysarmy Posted May 1, 2015 Author Posted May 1, 2015 OK, so we are going to give him some old PC's. One has 16Gb of RAM on which we've installed Server 2012 r2 and the other four we've put on Windows 7. What are our options for licencing? It's going to be off our main network so KMS won't work, if we put in some MAK keys then there will be nothing to stop the students finding these out and re-using them away from school!!! If we don't put in any keys then windows will report it's not genuine, but will that be a problem for a test network? or is there another way? Cheers
Boredguy Posted May 1, 2015 Posted May 1, 2015 Your limited to using MAK keys only as your test network will fall under the 25 station requirement for KMS... Or you can run it in nag mode and rebuild it every 120 days.
kennysarmy Posted May 1, 2015 Author Posted May 1, 2015 Your limited to using MAK keys only as your test network will fall under the 25 station requirement for KMS... Or you can run it in nag mode and rebuild it every 120 days. But with MAK don't I run the risk of students getting getting hold of that key and then re-using it off site???? So it will work for 120 days then I could re-image the server and the four clients?
kennysarmy Posted May 6, 2015 Author Posted May 6, 2015 But with MAK don't I run the risk of students getting getting hold of that key and then re-using it off site???? So it will work for 120 days then I could re-image the server and the four clients? bump - anyone?
Boredguy Posted May 6, 2015 Posted May 6, 2015 Yep, every 3 months (or when Windows decides your grace period is up) just reinstall, assuming the students have not done something in the meantime that meant a rebuild was needed sooner.
mjs_mjs Posted May 6, 2015 Posted May 6, 2015 Correct me if I'm wrong but without anything in place and with everything on one vlan, there will be 2 DHCP servers one giving out IP and DNS settings for your main network and the other giving out DHCP addresses for the test network. The effect will be less if you had seperate vlans i.e. end devices seperate to server vlan. Active Directory relies heavily on DNS. You can avoid this by only allowing and configuring 'trusted DHCP servers' on your switches. This will effectively block all other DHCP servers from receiving the DHCP request and therefore clients will only see the correct DHCP server. It's called various things depending on brand/firmware. Any worse than a kid bringing in their laptop? again - this for DHCP/DNS issues should be covered by the above - but also RADIUS can help protect your network from attacks that start with this nature.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now