How to Implement Network Segmentation

To segment networks, you can use routers, firewalls, and L3 switches with the virtual lan vian function. Without these devices, how can we achieve network segmentation? Here we will introduce three economical and reliable methods to achieve network segmentation without the above equipment.

As the number of computers in the campus network rapidly increases, computer management and computer security issues become increasingly prominent. In the early stages of network use, because there are few information points, we only need to set it into a subnet, and there is no network segmentation problem. With the increase of users, we must take measures to strengthen the management of network segments. Network Segment management not only facilitates network maintenance, but also reduces the scope of the conflict domain and isolates the broadcast storm within the network segment so that it does not affect users in other network segments, this improves network stability and actual available bandwidth.

Multi-nic host soft Routing

This is achieved by installing multiple NICs on Windows 2000 Server and using the vro feature of Windows 2000 Server to achieve segment management of the network.

The following describes how to create two CIDR blocks. Suppose we want to create two CIDR blocks: CIDR Block A with the Address 192.168.1.0 and CIDR Block B with the Address 192.168.2.0. They are all fixed in the first three segments of the class C subnet IP address, and the last segment is arbitrary). The subnet mask is 255.255.255.0. Now, two network segments are connected by two NICs installed on the host. Network Connection 1.

I. Host settings

Take a host running Windows 2000 Server as an example. The specific implementation steps are as follows.

1. Install and set the NIC

After two NICs are installed, set the IP address of the first Nic to 192.168.1.1 and the IP address of the second Nic to 192.168.2.1. The subnet mask is set to 255.255.255.0.

2. Set vro

1) Select "program> Management Tools> route and remote access" from the "Start" menu ".

2) In the "Tree" column on the left of the "Routing and Remote Access" window, right-click the "Server" item, in the shortcut menu that appears, select "configure and enable Routing and Remote Access.

3) in the pop-up "Installation Wizard for Routing and Remote Access Servers", click [next]. When the "public settings" step appears, select "network router" and click the [next] button.

4) In the next "routing protocol", you should be sure that there is "TCP/IP" in the "protocol" list box. If there is this protocol, you can click "yes, all available protocols are on the list. "Click [next] to continue.

5) Next, the system will prompt: "Do you want to access the remote network by requesting dial-up ?", Click "No" and then click the [next] button to complete the configuration of the vro.

Ii. Client settings

If you want to achieve mutual access between computers in the two IP address segments 192.168.1.0 and 192.168.2.0, you must configure the corresponding settings for the client after installing and setting the IP route. For computers in the 192.168.1.0IP address segment, you need to set its default gateway to 192.168.1.1; for computers in the 192.168.2.0IP address segment, you need to set its default gateway to 192.168.2.1. After the default gateways are set for computers in the network, mutual access can be achieved between computers in different network segments.

Iii. Notes

1. TCP/IP and IPX/SPX protocols support routing, whereas NetBEUI does not support routing.

2. Windows 2000 Server supports routing connections between four NICs.

Multi-nic Routing Based on layer-2 switching

The premise for implementing this routing mode is that each network segment has a host that requires two NICs. This method is applicable to different data centers in the school. The host can run Windows 98 or Windows 2000 on the operating system, the following uses two CIDR blocks as an example. The CIDR blocks are the same as those in the preceding example. Network Connection 2.

I. network segment A host settings

Two NICs are installed. the IP address of the first Nic is set to 192.168.1.1, And the gateway is not set. the IP address of the second Nic is set to 192.168.2.254, And the gateway is set to 192.168.1.10. The subnet mask is set to 255.255.255.0 ".

Ii. network segment B Host settings

After the two NICs are installed, the IP address of the first Nic is set to 192.168.2.1, And the gateway is not set. the IP address of the second Nic is set to 192.168.1.10, And the gateway is set to 192.168.2.254. The subnet mask is set to 255.255.255.0 ".

3. Client settings

The setting is the same as that of the client in the previous example.

Iv. Description

The dual-network interface is used to achieve network segmentation. Many implementation methods are available. You can choose one based on your own situation. The biggest advantage of this method is its simplicity, practicality, and low cost. However, when the network size is relatively large, this method is not easy to manage and may cause network congestion.

IP Forwarding Method

To achieve network interconnection in the first way, you must use one host and two NICs between each two network segments to connect two different network segments. If the network size is a little large and the network segment is large, this method makes network maintenance and management more complicated. Therefore, we can set up a host for IP Forwarding, if a computer on a CIDR Block wants to access a computer on another CIDR Block, IP Forwarding is performed on the host.

IP Forwarding refers to the process in which an IP packet received by a network interface is forwarded to another network interface. This means that the host performing IP Forwarding is neither a data source nor a receiver. This type of host is essentially connected to two or more networks. The host receives an IP packet from a network and analyzes the IP packet to decide which network the routing mechanism is used to forward the IP packet to, and then uses other network interfaces to send the IP packet to the destination. The following describes how to implement IP Forwarding Based on a specific instance.
I. network structure and configuration methods

For convenience, a simple network model 3 is designed here ). Assume that the network is divided into three network segments: 202.100.204.152, The subnet mask is 255.255.255.255.248, the server subnet, 192.168.2.0 is the instructor subnet, and 192.168.3.0 is the student data center subnet ). In addition, the Intranet is connected to the ddnleased line. The Ethernet port address of the router is 202.100.204.158, And the IP address of the IP Forwarding host is 192.168.2.254. The computers in the subnet of the instructor subnet and the student data center can access internal servers in the subnet of the server area and directly access the Internet.

Ii. settings of Windows 2000 Server host and client

1. Bind three IP addresses to the host so that the host can access the preceding three CIDR blocks. First, set the IP address to 202.100.204.153 for the network adapter of the host, set the subnet mask to 225.225.225.248, and then bind two virtual IP addresses, 192.168.2.1 and 192.168.3.1, respectively. After completing this step, all the computers on the three sub-networks can access the host, but IP communication is not allowed between subnets.

2. Start the host route forwarding service, and start the Routing and Remote Access Service in Windows 2000.

3. After the host route is set, you must also set the client accordingly. For computers in the 192.168.2.0 CIDR Block, set the default gateway to 192.168.2.1. for computers in the 192.168.3.0 CIDR Block, set the default gateway to 192.168.3.1. After the default gateways are set for computers in the network, mutual access can be achieved between computers in different network segments.

4. If the instructor subnet and the computer on the student subnet need to access the Internet, you also need to configure a default gateway for the host to point it to the Ethernet port address 202.100.204.158 inside the router.

Iii. Description

Although IP Forwarding can easily achieve communication between networks, it cannot effectively prevent network storms, and hosts may also become a communication bottleneck.