Any network is going to be chopped up into individualized zones.
Now if you've been watching other episodes you know we talk about things like land and women and such
but we're actually going to make it a little bit more granular than that.
So what we're going to be doing is really talking about more than anything else an individual local
area network or at most a small way.
And some of the different denizens and pieces and chunks that we divide that land into.
So the best way to get started with understanding the different types of zones that you're going to
be seen on security plus is to start with a good old basic local area network.
Now when you look at a local area network you've always got some number of computers that are all connecting
into one or more switches generating their own broadcast domain.
The important thing I want to stress in terms of a zone though is that this type of local area network
is going to be wired actually will have physical Ethernet connections using physical switches to do
whatever it needs to do.
So this is the core zone of just about any network.
So what we want to do is we want to build from that zone.
And there's a lot of different things you're going to see every one of these on the security plus I
also might add all of these are covered in other episodes with a lot more depth.
All I'm trying to do at this point is to make sure that you're thinking in terms of zones.
There are a number of questions on the security plus where you're asked to think about how this is all
put together.
So for right now we're going to keep it a light touch.
And if you want more detail on DMZ or virtualization I've got a whole other episodes for it so let's
go and get started with the first one which is going to be the plan.
So a villain simply means that we can take one or more physical switches and chop it up into separate
broadcast domains.
So let's imagine our local area network in this case I've got one switch but what I'm going to do instead
is let me just change some colors here so all of the different computers that are on the same color
are on their own broadcast domain.
And if they're in a different color than their color they're not even getting to hear each other.
They can't broadcast to each other anything that would actually have to have a router to interconnect
these different virtual local area networks so the plans are not only common.
They're pretty much standard in all but the smallest of networks out there.
Even my little company Total seminars runs a number of different plans to allow us to have different
zones so I've got one zone that's really more for the front office and the accounting folks.
We've got another zone that's for our video production.
And it just makes it a little bit easier for us to provide good security by setting up the LANs.
The next type zone I want to talk about is pretty much unique for people who are serving stuff out on
the Internet and this is called a DMZ or demilitarized zone.
So if we start off with our little local area network.
Now traditionally you're going to have some kind of router that pre-text your local area network from
the big bad evil internet while still providing new connections through that router that we get to Google
and whatever it might be.
But a DMZ is actually a usage of two different routers.
So what we do is we can have our local area network to have a router connection and then we're going
to connect that router to another router and then out to the Internet by doing this what we can now
do is we can insert servers web servers files servers VPN servers whatever type of actual servers public
facing servers with public IP addresses can be placed between these two routers.
So the IP addresses between the two routers are public IP addresses usually the IP addresses that are
inside the locally or network are private IP addresses.
You can't get to those computers from the Internet itself.
The DMZ is a perfect tool for supporting servers with that what we call the front router the gateway
router the one that's between our servers and the Internet.
We can provide strong firewall services there while at the same time allowing public Internet to come
in and be able to talk to the servers if we've got a web server.
We don't want to block the firewall to the point where they can't even speak to the right that next
firewall in now that's the one that really is going to protect our individual systems.
So it will block all incoming public internet stuff unless somebody on the inside starts the conversation.
So so by the way on the inside here they can go ahead and open up a web browser and type www.youtube.com.
And then because they've started the conversation when it comes back in in that particular case then
public IPs can come into your interior network.
But within the DMZ anybody can query any of those servers.
And we want them to do exactly that.
DMZ is or I'm not going to say they're gone but there's a lot of new opportunities out there.
With cloudbase tools we're a traditional old school DMZ with two routers is more rare than it used to
be but it's certainly on the exam.
The next thing I want to talk about are wireless networks.
So if we start with our little local area network we can do things like for example just plug a wireless
access point into our switch and then provide another zone of network called a wireless network.
This is based on the ATO to 11 standard that little wireless access point broadcasts out what we call
SS IDs service set identifiers and that's when you get on your phone or on your laptop and you're looking
at all those wacky names.
That's really what those are individual societies.
So that gives us a another set of connectivity.
Now keep in mind that unless you do something special a wireless connection is just as good as plugging
a piece of Ethernet into a switch.
So a lot of times that's where we'll see people do things like for example set up a separate Vili's
And that's just for wireless clients.
So make a little separation maybe put a firewall between the wireless clients and your actual LAN itself
now after that we have what the exam calls a guest network.
That guest is an interesting name because guest has so many different means to it.
For example a guest network could be at a coffee shop where you're just providing public Wi-Fi to your
patrons.
A guest network could be something I've done a lot of work with the United States Department of Justice
and they need to be able to give defense attorneys a way to get to look at any type of evidence that's
being used against their client so they have to set up little guest network which manifest is nothing
more than a piece of Ethernet that they can plug into.
The important thing is that a guest network is a pretty much always going to be a separate view and
one way or another it is designed and protected because you're assuming that guests are not people who
can log into your actual network.
So there's a it's a very much a segmented almost isolated zone that really is used for one specific
job.
It can be wired it could be wireless but there's always going to be certainly a violation and almost
certainly some big firewall between the guest network and your real network because we don't want those
defense attorneys looking at anything else.
So you have all of these different types of zones.
But today probably one of the most common zones that we get into are virtualization zones in virtualization
and again we have whole episodes that cover this in more detail.
We can take one computer and make it look like a gazillion individual computers.
So here's my one computer.
And what we do is just put a bunch of virtual machines on top of that.
It's actually all of these machines are running within this one physical computer.
In fact with virtualization whereas each system can be connected to your actual network it's actually
very common where you have your own virtual ised network.
So all of these computers can be their own little LAN running together by themselves.
And it just depends on what your application requirements are.
So virtualization is used a lot in terms of when we think about the zones.
Now the last kind of zone and this is an important one is called air gap.
So let's imagine I've got two local area networks now it's nothing for me to run a cable between two
switches and I can make these two local area networks become one larger local area network an air gap
simply means a disconnect.
We unplug different networks from each other to provide real isolation when a system is not connected
to any other systems.
It is completely isolated and this is actually very common.
Did you don't here in the United States we have the Internet which everybody uses.
But there's another Internet in fact arguably there's three other internets and they're completely air
gapped from each other they're used by the United States Department of Defense.
They're used by university research departments and they're a completely separate Internet from the
one that you get on google with so it's very very common to see these types of air gapped networks.
All right.
Now for the exam.
Just make sure you're comfortable conceptually with the idea of zones.
Hopefully most of these terms you're familiar with if not don't worry about it.
We've got plenty of that acids that will talk in detail about virtualization and lands and DMZ.
You're just going to have to poke around a little bit and find them.
But they're there
for
an.