Best way to segment the network

Comments

5 comments

  • Avatar
    Firewalla

    This is the artistic side of networking :)

    I have following

    1. Guest network ... block adult content / ... video 

    2. IoT network ... nest, cameras ... all devices that don't require LAN to LAN, and not complex devices (iPhone is complex, and a Nest thermostat is not). This way I can easily apply any policy over them.

    3. Main network ... for everything else 

    0
    Comment actions Permalink
  • Avatar
    David Vaughan

    As Firewalla said, the art rather than science of networking. Our division is this:

    1. All personal [i]devices and associated things like Apple TV, wireless DAC, NAS.

    2. Rudimentary household things without particular agency, e.g. air purifiers, switches.

    3. Security, aka intelligent systems with cameras :)

    Category 2 is limited to 2.4GHz wireless (separate AP) not shared with anything in category 1, while category 3 is wired only. Placement of network switches and APs derives from that design. We have no guest network. Either you are family and trusted on 1, or use your own 4G/5G mobile data just the way I expect to use mine if I visit you.

    The whole is a set of trade-offs between perceived/actual risk and utility/convenience.

    0
    Comment actions Permalink
  • Avatar
    Abbas Jaffar Ali

    Thanks for both. I am getting ready to do this and will try 1 VLAN at a time. I will start by moving all the Ring cameras and devices to their own VLAN. Consiering that Ring uploads data to the cloud, I will need to allow Internet traffic. I am assuming it will also need access to LAN so ithe security devices can ping each other (motion sensors etc.) Not sure if it uses local network or cloud when I access a camera from my phone.

    So for Ring, do I create an all access network? And if yes, then the question is why should it be on a different VLAN if it can access my network and the internet? 

    0
    Comment actions Permalink
  • Avatar
    Sukumar Patel

    I have split my network as done above.
    1. Main network for all of mine and spouse's devices
    2. Kids network for kids with porn, vpn, shoping etc blocked, set to low priority in smart queue
    3. IOT for all the switches, bulbs, Google Homes etc

    I also have smart queues to set Zoom, Teams and WebEx to highest priority.

    0
    Comment actions Permalink
  • Avatar
    Chris Thomas

    My network is currently segmented as follows;

    1. Mgmt network for switches, access points, security system, home automation server, and NAS (No wireless, default block, egress is very tightly controlled)
    2. User Wireless for devices that need to communicate with each other (phone or laptop to roku, chromecast, or connected speakers)
    3. Guest Wireless with full-client isolation for guests, kids, and any IoT device that only needs Internet Access
    4. DMZ1 contains a single server that forward a port into (if it were compromised, it cannot reach any other networks, and cannot egress to the internet)
    5. DMZ2 for a point-to-point wireless connection to another location

    I have Smart Queues enabled for Google Meet, Zoom, Teams, and Webex.

    0
    Comment actions Permalink

Please sign in to leave a comment.