Should Servers be on Their Own VLAN in an Enterprise Network?

When it comes to network design, it is typically considered best practice to place your network servers within their own dedicated VLAN. But why? And is this always the case or are there situations in which you would use a different approach?

In this article we’ll examine these questions and more about how to deploy servers within an enterprise network.

We’ll take a step back and talk about network segmentation, and then we’ll see how it pertains to the deployment of servers within an enterprise network.

Network Segmentation

Network segmentation is an approach used in network design to separate a network into logical segments. When we talk about network segments, there are several concepts associated with them:

• Broadcast Domain – A Layer 2 domain where broadcast communication occurs. It is called a broadcast domain because any broadcast messages sent within this domain stay confined to it.
• IP Subnet – When it comes to IP addressing using either IPv4 or IPv6, each broadcast domain should contain hosts belonging to a single IP subnet.
• VLAN – A virtual LAN is a logical construct within a switch that logically defines a single network segment at Layer 2.

When designing network segments, all hosts within a particular VLAN should have IP addressing assigned within the same subnet, thus existing in a single broadcast domain.

Communication between different IP subnets within differing VLANs/broadcast domains can only take place via routing. In other words, via the default gateway configured for that particular IP subnet.

Benefits of Network Segmentation

If you’re already familiar with these concepts, then this should be a simple refresher. However, it’s important to clearly understand the advantages of such a design approach. The benefits include:

1. Introducing a hierarchical design to large enterprise networks – Separation of a network into network segments introduces a hierarchy that can be beneficial for scalability as well as network maintenance and troubleshooting.
2. Broadcast traffic limitation – For networks using IPv4, network segments with an extensively large number of hosts can produce a lot of broadcast traffic within the segment that can cause performance degradation. Keeping the number of hosts within each network segment relatively small helps to improve such performance issues.
3. Network segments should be assigned based on function and location – By assigning network segments to particular departments (i.e. sales, marketing, R&D etc.) or to particular locations (a single floor of a building), it improves network efficiencies, ensures network segments are geographically limited in scope, and allows security policies to be applied on a per-network-segment basis to hosts with similar requirements.
4. Security – Security policies can be applied at the edge of each network segment, and in particular, at the gateway that serves that network segment. This gives more control over what communication is allowed and disallowed within that particular network segment.

Benefits of Defining a Server VLAN

Now having gone over the general benefits of network segmentation, let’s take a closer look at how such a network design approach is beneficial for servers.

Servers deliver network services to the hosts that exist on the enterprise network, and as such, they are mission-critical components of the network.

Their continuous and reliable operation is of utmost importance, and network segment design should reflect that significance.

1. Enhanced Security

Arguably, one of the most important, if not the most important reason for placing your network servers in a dedicated VLAN is security.

Security policies including access lists, as well as firewall rules can be applied at the gateway of the specific network segment. Since the gateway is the only point of entry into each subnet, it ensures that all servers protected “behind” security policies that guard them from potential attacks.

In this way, servers are not only protected from attackers on the Internet at large, but they’re isolated from other internal network segments, safeguarding them from potential attacks that may take place from inside the organization’s network.

2. Improved Performance

Deploying dedicated VLANs for servers gives more control over the flow of network traffic to and from these mission-critical systems.

Servers in their own VLAN are insulated from unnecessary broadcast traffic from other hosts, reducing overhead, while the segregation ensures optimized traffic flow with more predictable and efficient performance.

3. Simplified Management

Separating servers into their own VLAN simplifies resource management by enabling easier monitoring and control of network traffic.

This segmentation allows for the efficient application of network policies, such as Quality of Service (QoS), shaping, and policing, tailored specifically to the needs of the server VLAN.

Additionally, isolating server traffic makes troubleshooting more straightforward, as any issues are confined to the VLAN, ensuring faster diagnosis and resolution without impacting other parts of the network.

4. Scalability and Flexibility

Adding new servers to a VLAN is a straightforward process that does not affect other parts of the network, enabling simple and easy scalability.

Additionally, workload segregation becomes more efficient in especially large networks. Different server types, such as database, application, and web servers, can be assigned to separate VLANs, allowing for better resource management and optimization of performance.

A word about Server Virtualization

Today, a significant percentage of enterprises are leveraging server virtualization to run their network services.

With on premises virtualization infrastructure, the advantages of the use of VMs can be enjoyed. As VM infrastructure grows, the logical separation of those systems from the rest of the network, as well as from each other is necessary.

By using VLANs within the virtual network environment, traffic between VMs can be segmented, ensuring that sensitive or critical workloads remain isolated from general or less secure traffic.

VLANs enable more efficient traffic optimization by allowing administrators to prioritize specific types of traffic, apply tailored network policies, and minimize unnecessary interactions between VMs.

This level of control is particularly beneficial in dynamic virtual environments, where workloads may frequently change, and ensuring consistent performance and security is essential.

Server VLAN Drawbacks

Now we’ve talked about the various benefits of the use of network segmentation for network servers, and there are many! But are there any drawbacks? Are there any situations in which you would place a server in the same subnet as your regular hosts?

Although it is true that in the vast majority of cases, your servers should have their own dedicated VLAN, when you have a very small network, like in an office with up to 10 workstations, you may “bend the rules” in favor of a single subnet for all devices.

If you have one or two servers serving such a small network, it’s simply not cost effective to purchase the required network equipment to deploy multiple subnets and security policies on those subnets.

Employing security policies on the servers themselves using their operating system firewalls may be a more financially sound alternative.

But once a network increases in size beyond a particular critical mass, which will depend upon both the physical size of the network as well as financial capabilities of the organization, it is virtually always required to deploy a dedicated VLAN for network servers.

Conclusion

Network segmentation is an indispensable technique used for designing networks, resulting in benefits in the areas of scalability, security, and management.

For network servers, either physical or virtual, network segmentation plays a significant role in securing these mission-critical systems, as well as enabling simple administration and troubleshooting.