LAN setup question

Joe2640 · Post by **Joe2640** » Thu Oct 24, 2002 8:59 pm

I'm a bit of a networking n00b, so bear with me

My dad needs to setup a 10 client network with a server and access to the internet. The server will be running Win2k server, and the clients will be running XP. My first question is, if the data that is on the server is important (i.e. medical records), what sort of firewall would be necessary to protect that? My other questions is a little more complex. Is it possible, with a 24 port +1 gigabit port switch that is unmanaged to connect that to a firewall (router?) and then out to the internet? Basically, my questions are, with the setup I told you guys, what would you suggest for the optimal protection and still be able to utilize the gigabit switch without having to go through the router?

I hope I explained it well enough, and thanks in advance

-Gordon

twwabw · Post by **twwabw** » Fri Oct 25, 2002 5:13 am

Nice! Setting up new networks is a blast- especially from scratch.

Since this is obviously a business, and the data is VERY important and confidential, you need a real firewall- not just a home class NAT router/gateway. There are many that will suit the application well- Cisco; Symantec Securtity Appliances; some of the upper end Nexland products; and my personal favorite- Sonic Wall.

Be prepared to shell out some cash- these are not your typical $100 dollar "routers" you see at Best Buy- these are enterprise class security devices, designed to protect your network against just about anything you can throw at them, and also have the horsepower to support a bunch of internal users behind them without choking. I would only consider devices that were ICSA-certified, stateful packet inspection firewalls. While many of the home class devices claim to be SPI, they do not offer the level of protection these devices will. Most also offer IPSec VPN capabilities as well, allowing you secure remote access to your network.

Is it possible, with a 24 port +1 gigabit port switch that is unmanaged to connect that to a firewall (router?)

Absolutely- that's exactly how you'll hook it up. ISP connection to firewall; firewall to switch; switch to the users. You don't need a managed switch for 10 users- unmanaged is fine. Buy a quality switch though.

still be able to utilize the gigabit switch without having to go through the router

Remember- you'll only be going through the router (firewall) for Internet access- internal lan traffic will strictly be on the switch. You really have no use for the gigabit uplink- it's a waste of money for you. You will not be hooking into another switch, or network segment to utilize the gigabit port. Your T-1 or broadband or DSL connection to the Internet will likely only be a 1.5 - 3.0 mbps connection. It will not be a bottleneck. A 100 baseT connection from a standard switch is more than adequate.

Post by **YeOldeStonecat** » Fri Oct 25, 2002 7:21 am

Take a peek at this thread, I do a lot of these.

https://www.speedguide.net/forums/ ... genumber=1

Like TWW mentioned, don't get a basic home router, get a more SOHO router that can handle the traffic, and be more reliable. For beginners, I like Nexland...their higher end series, or better yet, I like the firmware Symantec changes on Nexlands routers....Symantec sells a router made by Nexland, their Firewall/VPN appliance.
http://enterprisesecurity.symantec.com/ ... oductID=63

I also recently worked with my first Sonic Wall...I liked it despite a rough start (firmware corrupted out of the box...had to reflash it...but painless reflashing and setup after that)

As for going giga....or just fast ethernet, giga is not much more these days, as many servers come with a 10/100/1000 NIC built in now, or even if not, you can get one for hardly another 20 bucks. And for switches, copper giga single port switches are hardly any more also...and it gives much better throughput for the other 100 ports concurrently. What system is being put in? I just did a GE medical system system running on Oracle for a docs office...he skimped and went only 100 switched....in my opinion, he should have gone giga...that software is no ball of fire over a network...and he's only 6 users.

Use good password and security on the shares on the server. If remote management is to be put on for software support (such as PcAnywhere), be smart and don't use the PCA standard ports, and have the PCA host use a strong username and password.

If the software will be SQL based, it may be a smart move to use Small Business 2000 server....which will give him internal and external e-mail through full Exchange server, SQL server for a database, and a built in ISA server which runs Proxy and a full blown firewall...the server uses 2x NICs for that...I put the external NIC behind a NAT router also...so double walls for security.

twwabw · Post by **twwabw** » Fri Oct 25, 2002 7:56 am

Just my 2-cents..... I hate; have hated; and probably always WILL hate Small Business Server! Too restrictive; all your eggs in one basket; often difficult to add additional 3rd party apps due to integrated design. I could go on and on. Personal opinion only due to way too much annoying experience.

I also don't feel ISA server is a reliable, practical option for a NooB networking person to be responsible for configuring and maintaining. I would much rather see them behind a hardware solution, that didn't require the endless series of MS updates; patches; fixes; tweaks; and service packs. A colleague put it very well once- a software fire wall is broken until you fix (configure) it.... and a hardware firewall is fixed until you break it.

Post by **YeOldeStonecat** » Fri Oct 25, 2002 8:16 am

I thoroughly hated SB 4 and SB 4.5.....but through experience, feel that they got it right with 2K....very easy, and they're doing service packs now for SB exclusively...that does it all in one shot. Other updates easy as cake simply through Windows Update, just like any other server.

Regarding the NooB administering...yes, can be daunting when trying to do higher end things like rules for ISA...but honestly, for a medical office, having to follow HIPPA rules and regs, redundancy, security, solid back up procedures, and probably a database engine for the medical package...a NooB shouldn't be there in the first place...hopefully the server will be setup and managed by some IT Pro support....either through the software package vender itself, or some partnered VAR. This isn't going to be just an office of secretaries sharing a MS Word document, or some Act contact list and a printer...it's a medical office that has to maintain to high standards and liability, especially with HIPPA regs being implemented soon.

twwabw · Post by **twwabw** » Fri Oct 25, 2002 8:33 am

I thoroughly hated SB 4 and SB 4.5

Me too- still have a couple clients using it...

but through experience, feel that they got it right with 2K....

I agree that it's improved, but still a true compromise solution, only suitable for very small networks. I have a 35 client network running on 2K SBS- (not my choice- before I came) and many of the issues of 4.5 are still there. They are heavy Exchange users, and large file users. Dual PIII's, split Raid, a gig of memory, and it chokes. I can't imagine trying to also run a SQL database on top of a single box that is your schema master; DNS; running AD; running Exchange; file and print services; ISA; and then adding SQL! Plus, the possibility for single point failure is enormous. The temptaion of economics (ie: attractive OS pricing) is far outweighed by the potential for disaster. Only thing I like now is at least you can have another DC running.

Oh well- my opinion only

Post by **YeOldeStonecat** » Fri Oct 25, 2002 8:51 am

Originally posted by twwabw
Me too- still have a couple clients using it...

Yeah, I'm getting rid of my last one in a month or so....doing a big upgrade...I didn't install the original one either, and it's a mess. Went through originally NT 4...to NT 4 with Artisoft modem sharing, to NT 4 with a proxy trial ware, upgraded to 4.5 SBS...so the OS is a mess after going through all those upgrades. Yuck.

Your other points...true...but remember, it's intended as an all-in-one budget NOS for the small business. If you're worried about single points of failure, and wanting to split up all those jobs into several servers....then you're already up above a small business solution, and most likely out of budget already. It's meant for only 50 users max..you can't go higher. And a gig of RAM...yeah, bare minimum, I try for 1.5 gigs right out of the box...2.0 if you're using the SQL. And the shared fax that can dump right into Exchange...it's great. Bang for the buck, Symantec has a special SBS version of their CE NAV, Veritas has a special SBS version of BE. Bang for the buck for the small office...especially since many are using Great Plains, or Small Business Manager, for accounting....it's all being driven this way.

Joe2640 · Post by **Joe2640** » Fri Oct 25, 2002 8:46 pm

Thanks for all the help guys, you give great advice =)

edit: about the Gigabit port, I need it for the file/storage server -- all 10 computers could theoretically be accessing it at once, I didn't mention that in my first post

--Gordon

BDillon21 · Post by **BDillon21** » Fri Oct 25, 2002 9:11 pm

Yeah, definately go with a good firewall. Something like a Cisco Pix with intrusion detection would be good. I manage a network that deals with bank accounts, so we have a pretty complex network of servers and firewalls. Basically we have two firewalls that sandwich a DMZ that hosts our web servers. We also hve 2 honeypots set up as well, one in the DMZ that is semi secure and one within the network. A honeypot is a fake server that you leave wide open that has fake data on it. This way if someone were to get in, the honeypot would make an easy target and likely be the first machine compromised. A hacker would likely hit that machine first and be found before he could get to the critical data. You can usually use an old machine with the eval version of win2k server for your honeypot. We load ours up with fake spreadsheets, graphs, fake user accounts, fake databases and what not.

For someone with his needs, you may want to even look at using a third party for your security. Monitoring firewall logs on a data critical network takes a lot of time, I can usually spend 8 to 10 hours a week going through ours.
My point is, when is comes to personal data like medical records, don't take any chances and be prepared to drop some coin.