VLans - would it be useful for me>?

[MrGuvernment]

Hello my fellow network pro-stars!


question for our work offices.

okay here goes, hope idont loose you.


we have 6 people in our office who work here

we have 13 servers, mostly MySQL DB's, 2 HTTP servers, a backup system storage system for people documents and such.

Now,

3 of the people in the office directly access the database servers from their workstations to pull queries and update tables and such.

3 other people dont, they use our web interface to get pre-made reports in PHP to get data they need.

Now i want to limit access to the MySQL DB's / http servers and all as much as possible (not just user / ip via MySQL db it's self)

Would setting up a VLan be useful for me since i have a dell 24 port and 16 port managed switches, just not using the managed part right now

We are trying to improve internal security, ideally so only myself and one other person can access "everything" and everyone else has access to what they need.

i know, probably thinking domain controllers and such, but for such a small office, it just seems alot of work, i have tried one before and it failed, so i am looking at some other options for internal security, i am not so worried about people's desktops, as i have alot of firewalling in place to block all the trouble causing crap...



Any input or suggestions?

(as for Inet we have 2x 4Mb /1Mb cable lines and a 4MB Fiber line coming in soon which i am going to try an untablge firewall box to manage it all (all 3 connections )on a nice system.. should do the trick no?)

 

[niccoli]

VLAN's would be one piece of the puzzle to increase the security. You would also need a router or a switch that is capable of L3 routing. Put your servers on one VLAN/subnet, put your 3 people with direct sql on one VLAN/subnet and the other 3 on another VLAN/subnet. Then on the router you would setup ACL's to allow access to what you want for the various subnets. Not sure if untangle will do VLAN's or not...you could just put enough NIC's in one for each VLAN and have the untangle be a member of each VLAN but??

 

[MrGuvernment]

i was thinking untangle as the main firewall system, then out from it having my dell managed gigabyte switches handle the Vlan side of things, but i shall look into the L3 routing side of it.

Since i have 2 managed switches i could do one out from each vlan, if, as you said, untangle can do L3,.