> Generally, putting each customer into a dedicated layer 3 > network segment is a good idea - because half of the attacks > that a hacked server belonging to "customer 1" might do to a > server from "customer 2" (ARP spoofing, IP address spoofing > [-> blaim goes to customer 2], HSRP attacks to the shared > router, etc.) suddenly are no longer relevant at all.
The only disadvantage of this approach is that you waste up to 75% of the address space (assuming you have one server per customer). If you want to do some really weird things you could configure mismatched subnet masks on servers and routers, use host routes to point toward the servers ... This will reclaim almost all the address space, but result in somewhat more complex addressing and routing. Ivan http://www.ioshints.info/about http://blog.ioshints.info/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
