3.3.3. VLANs, Firewalls, and Static vs. Dynamic Addressing

💡 First Principle: Network segmentation (VLANs) and filtering (firewalls) exist because not all traffic should reach all devices. A flat network where every device can talk to every other device is a security and performance failure. VLANs and firewalls are how you enforce boundaries.

VLANs (Virtual Local Area Networks)

A VLAN segments a physical switch into multiple logical broadcast domains. Traffic within a VLAN behaves as if on a separate switch; traffic between VLANs requires a router (Layer 3 switch or router).

Server benefits of VLANs:

• Security: Isolate production, management, and storage traffic onto separate VLANs
• Performance: Reduce broadcast domain size, limiting unnecessary traffic
• Management: Place OOB management interfaces on a dedicated management VLAN

Firewall Configuration

Firewalls filter traffic by port, protocol, and IP address. Server administrators must understand:

• Ports: Each application service uses specific ports (HTTP=80, HTTPS=443, SSH=22, RDP=3389, DNS=53). Firewalls allow or deny traffic by port.
• Default deny: Properly configured firewalls deny all traffic by default and only permit explicitly allowed traffic. The alternative (default permit) is far less secure.
• Host-based firewalls: Software firewalls running on the server itself (Windows Firewall, iptables/nftables on Linux). Control traffic at the OS level regardless of network firewall configuration.

DHCP vs. Static (Configuration Perspective)

For servers: almost always use static IP. DHCP-assigned servers can lose their IP lease, causing DNS records to point to the wrong address, firewall rules to apply to the wrong host, and service dependencies to break. The one exception is a server with a DHCP reservation—an entry configured on the DHCP server that always assigns the same IP to that server's MAC address.

⚠️ Exam Trap: A server with an incorrectly configured VLAN tag will have network connectivity within its assigned VLAN but will appear unreachable from the correct VLAN. This is a common misconfiguration that looks like a cabling or NIC failure but is actually a Layer 2 configuration issue.

Reflection Question: A new server is physically connected to the network and has a correct static IP, but users on VLAN 20 can't reach it. Users on VLAN 30 can reach it without issue. What is the most likely cause?