How do you seperate your networks. Subnet / Vlan

[drjturner]

Hi

 

How are schools admin and curriculum networks seperared is it via vlan or subnet, or any other way?

[ChrisH]

Generally by VLAN or completely physically seperate wiring only meeting at the router.

[mrforgetful]

Ours was always physically sperate until we introduced email years ago when it was changed to be separated by VLAN, now we've gont 1 big flat network split up into multiple vLANs depending on room or building. And one for printers.

[webman]

Ours are one integrated domain, so we aren't separated at all.

[Face-Man]

We have 2 domain and 2 vlans at present but are moving to a flat domain with multiple vlans for the differnt rooms and admin etc.

[StewartKnight]

IPSec

[plexer]

No seperation at all either by physical cabling or vlan.

 

Ben

[CyberNerd]

some vlan - could be better

[projector1]

hi whats the benefits of having vlans setup please?

[CyberNerd]

hi whats the benefits of having vlans setup please?

 

Imagine two completely seperate networks - requires lots of switches and cables.

With vlans the network can be segregated onto different ip networks, but they still use the same switches and cabling.

[john]

Primarys all in one nice big mixture and works darned well if I do say so myself, as for my main place, 1 Domain, but most servers are shared with 2 cards, so we have 2 DHCP, 2 DNS, 2 WINS etc

[Geoff]

Be aware that VLANs aren't a bullet proof security measure. ARP flooding the switch will usually destroy any port tagging you have setup for the duration of the attack.

[mrforgetful]

Also the data sent within one vLAN doesn't affect the performance of the other vLANs. Theoretically if you set up a server in say, vLAN 2 and imaged all the machine in that vLAN, any computer not in vLAN 2 shouldn't be affected by the traffic.

[Geoff]

unless you max out the switches backbone.

[woody]

We kept our networks seperate until we needed to run SIMS in the classroom. Thought about using trust domain and other options as mentioned on here, but then realised that at the end of the day, the biggest security flaw was staff leaving their PCs logged in in the classroom. Long gone were the days when you could keep SIMS in the office. So we have one big domain for everyone, and we keep the permissions as tight as possible. And we shoot staff who leave themselves logged on. Saves on admin time since you only have to manage the one domain.

[mrforgetful]

Woody, what do you do about staff not logging off? Or them running SIMS and projecting the data onto the whiteboard? Or them leaving their computer unattended with SIMS logged in?

[woody]

What can you do??? Other than keep stressing to them the need to lock their workstations. If you can get the support of SMT and ask them to stress that this could be a diciplinary issue if data is compromized as a result of lax security by a member of staff, then you are better placed to deal with it.

 

I check who's logged in regularly with AB Tutor control. If a staff account is still active and it's obvious they are not around, I lock the workstation, then 'politely' remind them. Education is the name of the game.

 

With regard to them using their laptop for the IWB as well as sims, they can freeze the image on the projector if they need to leave something up on the board, but many staff like the pupils to see their register being marked. This gives the pupils a reminder that their attendance and punctuality is being monitored constantly.

 

Or, in some rooms we have given staff who prefer it a seperate fixed PC for Sims, and they can use their laptop for the IWB.

 

At the end of the day, especially if you have a laptop, there is no excuse for leaving sims logged in unattended. You can shut the lid to lock the laptop. Equally, it takes a second to do Ctrl-Alt-Del and Enter on a workstation. If it was their wallet or purse on the desk, I'm sure they would take a second to leave it secure even if a fight was going on outside.