Windows 7 multiple IP

[wardsidjame]

Anyone help please:

 

We have an issue where we need to connect some PC's into our DMZ, we have setup a new vLan (51) and connectivity into the device in the DMZ works fine if you connect via an access port on the switch.

 

However we have a need to multihome some PC's as they need access to this software, so for example we need to keep the machine on the main internal network, but then give the machine a second IP address so that when they need to connect to that software, they can do.

 

This works in priniciple and for about 10 minutes once we have set the machine to do this, the machine can connect and ping to both the internal network and the one in the DMZ. After about 10 minutes the Windows machine stops connecting to the network which doesnt have the trunk native vlan set on the switch port. Connectivity still works as if we reset the ip on the Windows 7 machine it will start connecting again, and then fail again within 10 mins (hence we know it isnt a network issue, no port errors and always works).

 

The switchport is configured as a trunk, so

 

Switchport mode trunk

Switchport trunk allowed vlan 31,51

Switchport trunk native vlan 51

 

We cannot add the device in the DMZ onto our network and route to it etc due to it being a 3rd party device, basically not sure why the Windows machine works fine for 10 minutes and then suddenly stops working.

[lostsoul]

Can you not just add a firewall rule to allow the PCs access to the DMZ resource? Multi-homing PCs is not something I would do.

[Blue_Cookeh]

I'd try not to multihome those either.

 

Can you not route them across VLANs and open up any ACLs you have for those specific devices?

[andydis]

2nd nic and adding routes

[FN-GM]

Can you not just add a firewall rule to allow the PCs access to the DMZ resource? Multi-homing PCs is not something I would do.

 

This is what I would be doing. Putting clients in a DMZ will expose security issues, the idea of a DMZ is to isolate the computers in there. Putting clients in the DMZ as well as the production network defeats the whole object of it. No point having it if you do that.

 

 

Also the native VLAN shouldn't be used for anything else. No clients etc should be in the native VLAN, this is a security risk. Doing so opens up the possibility of VLAN hopping, the attacker can access any VLAN they like. The native VLAN is purely designed so the 2 devices can communicate to establish and maintain the trunk.

Edited October 25, 2016 by FN-GM