IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.62 Suitable logical segmentation
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
With the help of appropriate network components, it is possible to segment a
network logically even if a fixed physical segmentation is already in effect.
This can be achieved using switches which operate on layers 2 and 3 of the
OSI model. As these switches recognise the protocols used on layers 2 and 3,
virtual LANs (VLANs) can be formed by controlling the data flow between
the switch ports. This makes it possible to create network groups which are
not mapped as such by the physical segmentation. In particular, this allows a
quick and dynamic formation and rearrangement of groups without any
modifications to the physical layout of the network. As in the case of physical
segmentation on layers 2 and 3, criteria concerning confidentiality, availability
and integrity are also to be applied here. Criteria for suitable logical
segmentation can be applied similar to the criteria for physical segmentation.
The following illustration shows one possibility of forming a VLAN with the
help of several layer-3 switches. The physical links between the stations and
the switches are represented by the connecting lines. Logical segmentation is
performed through grouping into VLANs using switches.
VLAN 1
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
VLAN 2
VLAN 3
Figure 1: Formation of VLANs using several switches
If the VLAN structure shown in Figure 1 were to be achieved by means of a
conventional physical segmentation, the layout shown in Figure 2 would be
the result. The individual LANs can be mapped here by means of shared
Ethernet segments, for example, and linked together with a bridge.