Hi,
Leonardo Gama Souza schrieb:
In this case I think you could configure Private VLANs, isolating each
customer in the same l3 network segment.
Private VLANs won't help you with ip-spoofing in the same subnet and
hsrp-attacks and not against arp attacks (but these can be prevented
using static arp-entries on the l3-device).
Matthias
-----Mensagem original-----
De: [email protected]
[mailto:[email protected]] Em nome de Gert Doering
Enviada em: quarta-feira, 26 de agosto de 2009 07:02
Para: Steve Bertrand
Cc: Shaun R.; [email protected]
Assunto: Re: [c-nsp] Large networks
Hi,
On Tue, Aug 25, 2009 at 08:58:32PM -0400, Steve Bertrand wrote:
This company was constantly having problems with what i called
broadcast
attacks. The network graphs would show traffic on all interfaces
spike
and normally the 100mbit uplink between the switches would saturate
and
the network would die. From that experience i took my time to
design
and deploy my network to be as correct as possible.
Out of curiosity, did your experience find that the issues were
related
to actual broadcast problems?
Generally, putting each customer into a dedicated layer 3 network
segment
is a good idea - because half of the attacks that a hacked server
belonging
to "customer 1" might do to a server from "customer 2" (ARP spoofing,
IP address spoofing [-> blaim goes to customer 2], HSRP attacks to the
shared router, etc.) suddenly are no longer relevant at all.
... and *if* you need to ACL one customer, or just shut down their
network segment (because they are busy attacking someone else), you
can be sure that it doesn't affect other customers ;-)
gert
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
