how to divide a LAN

what is the best solution to divide a LAN with the objective of security? let's say 3 departments in the office.. the accounting.. engineering .. and production.

and what is the simplest solution? is subnetting one of the solution?


tnx in advance

hi

The best solution to partioning or segmenting your LAN is pretty much VLANing it. A VLAN or Virtual LAN will give you the much required isolation between different departments in your workplace and also accomodates hierarchy n scalability. Trunking will allow you to continue the VLAN on different switches located on perhaps ... say different floors.

For eg. u hv the frontline technicians accessing the network from floor 1 and their Technical Manager accessing the same workgroup/ network/ network subsection from floor 2. Since they are gonna be accessing the same network but from different floors ..... Trunking between Managed VLAN embedded switches is the best solution here. Subnetting in such cases may help .... but for specific requirements only ... and actually does not provide any sense of security. Subnetting sometimes will only end up create more problems than it solves. Simple MAC level or 802.1Q Tag based VLAN should be the simplest way to approach this problem ..... n more often than not ..... the simplest way to solve a challenge is very often the best one !

Cheerz n beerz

yes subnetting could be a good solution provided how many divisions you want to make in the existing network structure, and how many hosts you need in each network subdivision. there are other options as well in forming workgroups, but at the end of the day it primarily depends on what your security needs are. you can even divide the network up by using hardware and subnetting combination.

Hi,
just like to add to tHe-SwItCh & Arani

Subnetting & VLAN are the options we have, the only diffrence is that Subnetting help us to Eliminate the Department at Network (IP Layer) level where as VLAN segments the Network at the Layer 2 (MAC).

I personally prefer VLAN because it is more secure and Have the options of assigning Port Level security based on MAC address information & eliminate Broadcast domain at the L2 Itself.

Cheers,
-VINOD M

for this the best resolution is configuring VLAN's port wise because this is the only option that provide the best security when we think about the secured division of LAN

ok. i will keep those informations.

thanks to all!