FragglePete Posted October 11, 2012 Posted October 11, 2012 Hi. Related to a post in a specific broadband consortium forum, so I apologise but I need to get a broader audience on this one. I've setup a VLAN for BYOD devices on our network and this is working well with the new transparent proxy service that SWGfL are offering. Obviously I want these devices completely serparated from the main network hence on their own VLAN and that's working nicely. The issue being is that these devices need to access two servers on the main VLAN (E-Mail and VLE). I was going to be a bit lazy and just let them type in the normal external address of these servers which then means traffic sort of goes out and comes back in again but it doesn't work because of the DNS setup. The DNS servers I'm using are SWGfL Servers which resolves a request for our frog server as the internal IP address, which makes sense as it even though its internal on our network, its on a range within SWGfL on our main VLAN - which of course the BYOD vlan can't access. I should really set it up properly, because it makes sense, just I'm a little unsure on how to do it on the core switch as I believe it involves setting up a ACL. My understanding is that I need to allow this VLAN to access the other VLANs and then apply a ACL to only allow it to access to these two IP addresses on the main VLAN. I would really appreciate help in the commands needed to configure the switch (with a little explanation) so I can understand it all a bit better. Hope the above makes sense? Much appreciated in advance, will give lots of Thanks ! Pete
glennda Posted October 11, 2012 Posted October 11, 2012 Do you have management of the firewall? As it would be better to setup the rules on the gateway rather then the switches IMHO 1
SYNACK Posted October 11, 2012 Posted October 11, 2012 Just have it all routable but instead of deny any any you just need to add an exception for the two addresses before the deny and maybe your local DNS so you can use the same mail.whatever.edu address to the ip addresses. 1
FragglePete Posted October 11, 2012 Author Posted October 11, 2012 Do you have management of the firewall? As it would be better to setup the rules on the gateway rather then the switches IMHO No Management of the Firewall, we're part of SWGfL. Swindon schools are a bit of an oddity with the setup as well, as the bearer goes to the LEA central hub and then is squirted out to schools via Point to Point Wi-Fi links. Don't really want things going out and back in across this anyway. Pete
FragglePete Posted October 11, 2012 Author Posted October 11, 2012 Just have it all routable but instead of deny any any you just need to add an exception for the two addresses before the deny and maybe your local DNS so you can use the same mail.whatever.edu address to the ip addresses. Ok - but need help putting that into practice. The BYOD VLAN is using the SWGfL DNS Servers, don't want them accessing the DNS servers of the main VLAN. Pete
glennda Posted October 11, 2012 Posted October 11, 2012 No Management of the Firewall, we're part of SWGfL. Swindon schools are a bit of an oddity with the setup as well, as the bearer goes to the LEA central hub and then is squirted out to schools via Point to Point Wi-Fi links. Don't really want things going out and back in across this anyway. Pete fair enough - then yes you need to setup the ACL's - let me lookup the config and I'll post back. Just going into a meeting and then i'll look. 1
SYNACK Posted October 11, 2012 Posted October 11, 2012 Ok - but need help putting that into practice. The BYOD VLAN is using the SWGfL DNS Servers, don't want them accessing the DNS servers of the main VLAN. Pete If you are not going to tamper with the DNS then you will end up needing to use different addresses/IPs for infernal vs external access. Even if you just setup a simple isolated DNS server that just holds the records of what you need to override and refers up to the SW---- server. You can have it right on the BYOD VLAN and it will save you massive hassle in the long run, otherwise you are building a big pile of problem that you will have to deal with in the future if you have no control over the upstream DNS and don't want to bounce traffic.
FragglePete Posted October 11, 2012 Author Posted October 11, 2012 If you are not going to tamper with the DNS then you will end up needing to use different addresses/IPs for infernal vs external access. Even if you just setup a simple isolated DNS server that just holds the records of what you need to override and refers up to the SW---- server. You can have it right on the BYOD VLAN and it will save you massive hassle in the long run, otherwise you are building a big pile of problem that you will have to deal with in the future if you have no control over the upstream DNS and don't want to bounce traffic. Appreciated - but when connected to the BYOD network/VLAN, the IP address resolved of the VLE server is the address of the server on the main VLAN. I'm trying to keep it simple but not introducing additional boxes to do stuff like DNS, NAT or whatever. We're sitting the BYOD devices on our secondary range of IP address allocated to us that we've never used. I'm want to keep it simple but saying to the core switch; if devices wants to go to IP address X you'll find it over there on the other VLAN but don't let them access anything else. Pete
SYNACK Posted October 11, 2012 Posted October 11, 2012 HP Procurve J9310A - 3 VLAN's with Access List: HP Procurve Access list, vlan acl I think the actual config commands are something like this, the ACLs look to be applied by VLAN name, in this the first one allows traffic for the local vlan addresses. You'll want to look the commands up in the CLU though. ip access-list extended "PLATE" 10 permit ip 172.20.20.0 0.0.1.255 172.20.20.0 0.0.1.255 20 permit ip 172.20.20.0 0.0.1.255 192.168.3.249 0.0.0.0 30 deny ip 172.20.20.0 0.0.1.255 10.0.0.0 0.255.255.255 40 deny ip 172.20.20.0 0.0.1.255 172.16.0.0 0.0.15.255 50 deny ip 172.20.20.0 0.0.1.255 192.168.0.0 0.0.255.255 60 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit vlan 192 name "PRECISION" ip address 192.168.3.248 255.255.255.0 tagged 23 exit As to the simple bit, having a box to do this is in aid of making it more simple and having to rewrite/mess with conflicting information is going to give you a headache. That said you 'may' be able to use nat to basterdise the VLE IP into the internal mail IP but this is a rubbish solution as it stops you if you actually do want to use the VLE from the BYOD VLAN. The other solution is to get SW--- to fix their DNS so that stuff resolves the way you need it to. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now