IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
VLAN 1
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Schicht-3-Switch
Schicht-3-Switch Schicht-3-Switch
VLAN 2
VLAN 3
Figure 3: Formation of secure VLANs with layer-3 switches
In this case (Figure 3), layer-3 switches are used to configure secure VLANs
on layer 3 of the OSI model. The switches illustrated here do not have a
routing function. VLAN 1, VLAN 2 and VLAN 3 operate as though they have
been segmented by means of a router, although no routing takes place between
them. In other words, VLAN 3 is not linked with any of the other VLANs;
only VLAN 1 and VLAN 2 can communicate with each other via a router.
Communications can be controlled by configuring the router in the required
manner. Other products which implement a routing functionality in the layer-3
switches eliminate the need for the displayed router, and allow routing with
the help of the switches.
A general recommendation concerning logical segmentation cannot be made.
During the installation of a new network however, a check must be made as to
whether VLANs would help fulfill requirements concerning availability,
confidentiality and integrity more easily than a more elaborate physical
segmentation.
One advantage of logical segmentation is the easy and central configuration of
new segments and reconfiguration of existing ones. Particularly in the case of
products which support secure VLANs, this allows a quick and easy formation
of workgroups in the network, which fulfill the high requirements concerning
the confidentiality of each workgroup's data. On the other hand, secure remote
access to the active network components also requires particular attention in
this case, as segmentation here is only based on software configurations.
During logical segmentation, a balance therefore needs to be struck between