Small collapsed network design advice

[e40956]

I am trying to design a small collapsed network. Here are the parameters:

1)There is no existing equipment.
2)Everything must be Cisco.
3)IBM Blade Chassis will be made up of VMware ESX hosts
4)ESX hosts will contain virtual machines with External DMZ servers AND Internal servers.
5)Should use as little equipment as possible.
6)Must be secure
7)Support 20 internal users and 5 VPN users.
8)External DMZ must support hosting for email proxy server and website(small number of connections)

As you may have noticed the DMZ is not separated at the firewall. I personally believe that at this point in time current technology makes this feasible as long as the proper security controls are implemented between the External DMZ VLAN and the rest of the network(IPS,ACL,vlan-hopping mitigation, etc).

Is there a more efficient way then shown in the following diagram?

Internet
|
Firewall/Router (ASA)
|
Internal Router(VLAN Routing) (
|
48 Port Switch----------------| 
|                             |
PCs/IP Phones         IBM Blade Chassis

Thanks

 

[North323]

thats pretty effecient. you could make that 'internal router' a layer 3 switch so that you only have the ASA and a layer 3 switch for vlan routing.

 

[e40956]

Thanks for the quick response!!

Follow up questions:

The Layer 3 switch would perform the internal routing, not the ASA correct?

What type of feature set would be needed on the Layer 3 switch to securely segment the DMZ from the rest of the network?

 

[baddos]

Yes a layer3 switch is a router, so you would have it do the internal routing since it would be the fastest option.

For the DMZ you could use the ASA as the filter or the switch. The switch would have better performance, but you would only be able to do packet filtering and not packet inspection if that is required.

 

[North323]

on the layer 3 you can create vlans to segment the DMZ with access-lists and routing to prevent access. you can also do QOS on the pc's and phone side

 

[unclerico]

In your drawing you have a L3 switch/Router and a 48-port switch listed. I don't know what kind of switch module you'll be putting into your blade, but what you could do is hang the 48-port switch off of the ASA to create a real, physically segmented DMZ. Within your VMWare configuration create a vSwitch and designate one or more physical interfaces to be used in the port group solely for servers in your DMZ. Plug those physical ports into your DMZ switch and voila you have the real, physical segmentation that you desire. You can do it with VLAN's if you want, but IMHO the more physical segmenatation you have between your DMZ and your internal network the better.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)