Network Segmentation

Internet networks are divided into segments for various reasons. Some of these reasons are related to the underlying networking technologies; others are related to geographical locations. Some of the best reasons to isolate network segments are based on network usage. If a lot of traffic in a network is between a few nodes, it’s best to isolate those nodes. This isolation drops the usage and provides a more responsive network for the other network users.

Other reasons to segment are to change networking technologies or to communicate between different networking technologies. For example, an office area may be running Token Ring and the shop floor area may be running Ethernet. Each has a distinct function. The office may require Token Ring to communicate with an AS/400. The shop floor may have Ethernet to enable shop floor controllers and computers to communicate. The shop floor information then may be uploaded to the office network for order tracking. The connection between the technologies is usually through routers. The routers forward only information that must be exchanged from one network to the other. This information can then be shared between nodes on the respective networks.

Excessive use of routers in a network can become a burden to the network, thus outweighing their benefits. The use of a router is of little benefit if all the nodes on one network must get to all the nodes on another network, and vice versa. In this instance, the advantages of routing would be diminished because of the overhead in the routing protocols. In that kind of situation, a bridge is a better alternative.

A bridge enables all information from two networks to be shared. The access is at the Physical layer and not at the Network layer, so address translation and routing overhead aren’t incurred. A bridge enables all information, including system broadcast messages, to be transmitted. If two networks rarely share information, a router is a better choice; otherwise, a bridge is the proper choice.

Internet Network Setup

The design and configuration of an Internet network is similar to the design of any computer network. It encompasses many types of nodes, including workstations, servers, printers, mainframes, routers, bridges, gateways, print servers, and terminals. The Internet requires that each device have a unique IP address. A device can have more than one address, depending on its function, but at least one address is required for communication with the other devices.

Understanding the Types of Connections

A TCP/IP network can consist of several systems connected to a local area network or hundreds of systems with connections to thousands of systems on the Internet. Each organization can create the type of network appropriate for its needs.

Figure 23.4 shows a simple network that consists of several workstations and a file server. Each station on the network is assigned the network address of 194.62.23. Each device is assigned an individual node address. This network is typical of most departments within a company or even a small office. There’s room to connect printers and more workstations to the network. The network has no provisions for connections to other local or wide area networks.

Fig. 23.4  A simple network.

The network in Figure 23.5 is more complex. It includes three separate networks interconnected through a combination of routers and servers. Each workstation and computer on each segment may or may not be isolated from using information on one of the other two networks. This is a characteristic of the subnet mask and security enabled on the servers and routers.

FIG. 23.5  A more complex network.

Information from one network is routed to one of the other networks on an as-needed basis. This type of configuration is typical of most large corporate networks. It may be chosen based on physical-length limitations of the underlying network technology or individual network loading. One or more of the networks may experience high traffic that must be distributed across several networks.

Router 1 between networks 1 and 2 provides for routing information between the two networks. If server 1 connecting networks 2 and 3 has routing enabled, information from network 3 to network 2 is routed. Also, information can be routed from network 3 to network 2 by means of server 1 and from network 2 to network 1 by means of router 1. Server 1, connecting networks 2 and 3, has two IP addresses: one IP address on network 2 and another address on network 3. The same is true for router 1, with addresses on network 2 and network 1.

Consider a situation in which there’s a lot of Internet network traffic between network 3 and network 1. In this case, it may be worthwhile to place an additional router between network 1 and network 3. The additional router can eliminate some of the routing overhead on server 1 and enable information to be passed between networks when server 1 is down.

The additional router can add a level of fault tolerance to the network. This fault tolerance is based on the fact that information can still be routed to network 2 from network 3, even when server 1 is down. The path between network 3 and network 2 would be through network 1 and router 1. Figure 23.6 shows the addition of router 2.

FIG. 23.6  The network after adding a second router for fault tolerance.

The fault tolerance of a network improves its integrity and can be of particular importance in certain applications. If time-critical information must be shared between two networks, an alternative path should be provided between the networks. This could be provided through the use of additional routers. Because these paths may be indirect (through a third network), a configuration parameter should be used.