Hi, On Tue, Aug 25, 2009 at 08:58:32PM -0400, Steve Bertrand wrote: > > This company was constantly having problems with what i called broadcast > > attacks. The network graphs would show traffic on all interfaces spike > > and normally the 100mbit uplink between the switches would saturate and > > the network would die. From that experience i took my time to design > > and deploy my network to be as correct as possible. > > Out of curiosity, did your experience find that the issues were related > to actual broadcast problems?
Generally, putting each customer into a dedicated layer 3 network segment
is a good idea - because half of the attacks that a hacked server belonging
to "customer 1" might do to a server from "customer 2" (ARP spoofing,
IP address spoofing [-> blaim goes to customer 2], HSRP attacks to the
shared router, etc.) suddenly are no longer relevant at all.
... and *if* you need to ACL one customer, or just shut down their
network segment (because they are busy attacking someone else), you
can be sure that it doesn't affect other customers ;-)
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpc9KwKF4kRw.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
