Multiple Networks Configuration

Brad1087 · Jul 29, 2014

I currently administer a small business network, which has the following network configuration:

|--> ADSL2 Modem/Router (Dynamic ISP IP/192.168.1.254) - WAN/LAN
|---->192.168.1.x Network. Devices - Web/File Servers(1), Printers(1), Guest Workstation(1), via a POE Switch (with 5 IP Cameras)
|---->Netgear FVS318 Firewall/Router (192.168.1.1 / 192.168.2.254) - WAN/LAN
|------>192.168.2.x Network. Devices - File Server(1), Hub(1), and Office Workstations(12). 5 Workstations are connected via the hub.
* Subnet Masks in all cases are 255.255.255.0, and there is a static route defined on ADSL2 Modem/Router - Network/Mask 192.168.2.0/24, Gateway 192.168.1.1

We are experiencing an issue whereby copying files from any workstation on the 192.168.2.x network to the file server on 192.168.1.x is extremely slow, sometimes 100Kbps (or less!). File copying has been done using Samba AND SFTP/SCP, and the performances are the same regardless of method/application. Copying files while on the same network is instantaneous, but between networks is unbearably slow! Internet browsing and email has no obvious complaints - the connection to the ISP is not the fastest, and therefore the expectation is set accordingly. However, moving files around our own network should be a relatively quick exercise - all machines are newish, and cabling is Cat 5e or 6.

Given the above, I am suggesting that the Netgear FVS318 might be the bottleneck. The reason for the two networks is for security, and using physical devices (and different IP networks) to separate the two has been the underlying motivation. Firewall rules allow a handful of ports open on the 192.168.1.x network, and nothing on the 192.168.2.x network.

I am considering purchasing a switch, and have read that one with VLAN capabilities might be the go, as I am led to believe that VLANs ensure network separation, and therefore (hopefully) security is maintained.

I guess my question is, if I did purchase a switch - What should it be, and why? And how would the network configuration look in doing so? Could it be that I could simply have the ADSL2 Modem/Router and Network Switch (with all devices connected to the new Switch, but separated by way of VLAN config). And how should I construct my network address assignment (ie. maintain 2 network address ranges? More/less?). Any recommendations?

Thanks in advance.

drtweak · Jul 29, 2014

well first off how are you trasfering files from the 192.168.2.X to the 192.168.1.X network? Usually that's not capable of being done using IP address since they are on a different subnet.

Brad1087 · Jul 29, 2014

Not sure I follow the question or the intent of the question. The environment is mostly Windows, with Samba file servers. To isolate that the problem was not Samba related, I have transferred files using SFTP/SCP - same poor performance, different copying methods.

bill001g · Jul 29, 2014

Try to turn all the rules off in the firewall just to test. If it goes to full speed you either have a rule pattern that is causing cpu load on the firewall or you are blocking something in the data protocol that the application is having a issue with.

First you need more than just vlans. A vlan is just a virtual switch. Just like real switches unless you connect them together somehow the data stays separate. It is seldom the need to keep the data completely isolated and when you start to connect them together you at least need some form of router. This can be a separate box or it can be inside the switch. A switch that can do routing is called a layer 3 switch.

Still this is just simple routing. When you want to restrict the traffic the router allows to between the vlans you then need filtering ability. Many layer3 switches or routers have the ability to do simple port filtering. This port filtering is what in effect makes a device a firewall. True firewalls though have very advanced options that allow filters based on patterns. They are smart enough for example to recognize things like FTP and know that even if you allow FTP though there is a dynamically assigned session that is negotiated. It will look inside the traffic to find and also dynamically put a rule in to allow it. They also can look at the URL themselves in web traffic.

So it depends how advanced your firewall filtering is. If you are using advanced features now it may be your problem and you only solution is a larger firewall. Something like pfsense running on a older dual nic pc can pass a lot of traffic. Otherwise you can get small firewalls from many companies. Things like sonicwall or even small juniper netscreens are not real costly.

If you can get by with simple port and ip filters there are many inexpensive layer3 switches that can route the traffic between the vlans with close to zero delay even with all the ports are running at full capacity.

Brad1087 · Jul 30, 2014

Thanks for your comments there Bill...you've certainly given me a lot to think about. Appreciate it. I did review the firewall situation, and it basically blocks everything, no option to allow incoming traffic (or not).

I'm still trying to do my homework, but at the moment I am thinking as the ADSL2 Modem/Router still has routing abilities (albeit they might be basic), and I may just be able to put a solution together with a switch and the ADSL Modem/Router. If I need to reconsider the IP address topology and bring everything back to one network, then I will do so.

My thoughts were to try to maintain two networks, with the view to also maintaining a degree of security - one network would allow some incoming traffic, the other (Office network) would not allow ANY incoming traffic - and by that I mean, traffic which is initiated from outside. I will be the first to admit that my networking knowledge is not strong, so maybe my thinking is a little off here - but I saw security (as well as speed) as important pre-requisites. Perhaps I should have worded my questions slightly differently.

Many thanks for your input.

drtweak · Jul 30, 2014

Well the reason why I was asking how you transfer the files is because of this.

You have two different subnet networks. One that is 192.168.1.X and 192.168.2.X Now because of this they can't just talk to each other normally especially with a router in between them, BUT the router actually has little to do with it. The reason why I'm asking "how" is because if you are using a FTP/VPN/Or some other kind of connection especially if your connecting to it using the External IP that is given to you by your ISP the Traffic is actually going OUT to the internet and then BACK in. So the transfer speed would be limited by your Internet Connection.

So that is why I ask how you are transfering the data back and forth. THAT is the biggest question her. The firewall would come second. In most cases the firewall would either allow it or block it. If QOS is setup on one of the routers that as well can be an issue.

So like you said. You tried SFTP and same different. How are you connecting to the other server? What is the host name you are using for the SFTP Connection?

Search

Multiple Networks Configuration

Brad1087

Reputable

drtweak

Illustrious

Brad1087

Reputable

bill001g

Titan

Brad1087

Reputable

drtweak

Illustrious

TRENDING THREADS

Latest posts

Moderators online

Share this page