{"id":31395,"date":"2019-10-31T21:41:01","date_gmt":"2019-10-31T18:41:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\/"},"modified":"2019-10-31T21:41:01","modified_gmt":"2019-10-31T18:41:01","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","title":{"rendered":"How to Take Control of Your Network Infrastructure. Chapter Three. Network Security. Part Three","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

This article is the fifth in the series 'How to Take Control of Your Network Infrastructure.' You can find the contents of all articles in the series and links here here<\/a><\/noindex><\/i>.<\/p>\n

This part will focus on Campus (Office) & Remote Access VPN segments. <\/p>\n

\"How
\n
\nIt may seem that designing an office network is simple. <\/p>\n

Indeed, we take L2\/L3 switches, connect them together. Next, we perform basic VLAN configuration, default gateway setup, establish simple routing, connect WiFi controllers, access points, install and configure ASA for remote access, and rejoice that everything works. Essentially, as I mentioned in one of the previous articles articles<\/a><\/noindex> in this cycle, almost any student who has taken (and understood) two semesters of telecommunication courses can design and set up an office network, so that it 'kind of works.'<\/p>\n

However, the more you learn, the less simple this task seems. Personally, the subject of office network design does not seem simple at all to me, and in this article, I will try to explain why.<\/p>\n

In short, many factors need to be considered. Often, these factors contradict each other, and one has to seek a reasonable compromise.
\nThis uncertainty is the main difficulty. When it comes to security, we have a triangle with three corners: security, employee convenience, and solution cost.
\nAnd each time, a compromise must be sought among these three.
\n<\/a><\/noindex><\/p>\n

Architecture<\/h2>\n

\nAs an example of architecture for these two segments, I, as in previous articles, recommend Cisco SAFE<\/a><\/noindex> model: Enterprise Campus<\/a><\/noindex>, Enterprise Internet Edge<\/a><\/noindex>.<\/p>\n

These are somewhat outdated documents. I mention them here because the fundamental schemes and approaches haven't changed, but I prefer this exposition over that in the new documentation<\/a><\/noindex>.<\/p>\n

Without urging you to specifically use Cisco solutions, I still believe it\u2019s helpful to closely examine this design. <\/p>\n

This article, as usual, does not claim to be exhaustive, but is rather a supplement to this information. <\/p>\n

At the end of the article, we will analyze the Cisco SAFE design for the office in light of the concepts presented here.<\/p>\n

General Principles<\/h2>\n

\nThe design of the office network must naturally meet the general requirements discussed here<\/a><\/noindex> in the chapter 'Quality Design Evaluation Criteria'. Aside from price and security, which we intend to discuss in this article, there are still three criteria that we must consider when designing (or making changes):<\/p>\n