we intend to build a network in a small health center with No Internet Access

it is expected to have 30 terminal machines, all machines will use an electronic medical record web application

we want to "hide" the application behind firewall

  • Hi Mokokamello - can you give some more information, for example what is the structure for, where is it (is it a family network with blog on the webserver, or a small office network with webserver, or something in between?)
    – Rory Alsop
    Commented Dec 21, 2010 at 0:03
  • @Rory Alsop check my edit Commented Dec 21, 2010 at 0:09
  • Will update accordingly.
    – Rory Alsop
    Commented Dec 21, 2010 at 0:13

2 Answers 2


Updated to take into account the zero Internet Access:

As you have mentioned, the switch can be configured to route the ISA server to segregate the application from the users. It looks from your model you are expecting the ISA to run a public and private VLAN through its connection to the switch.

More typically having a dual homed firewall is considered more secure, as traffic on each network is physically separated by the firewall. But basically the app server will connect to the ISA on a network port for the 'protected' side, and a network port on the 'user' side of the ISA will connect to the switch.

You can obviously use access control lists in the switch to provide further controls, however this may be all you need in terms of infrastructure.

alt text

One risk to look at is how likely a PC is to be attacked in your environment. Are they left unattended? And unlocked? Your infrastructure may then not be sufficient.

edited to say - if medical/personal data is on the server, and you are in a country with strong regulations in this area you may need to use stronger controls.

  • 4
    @Mokokamello - Logically you can make your setup work, but the risk is higher. ie you can use your switch to route traffic from users to ISA, ISA to App server and back, it just has a lower degree of segregation. Generally I would try to describe the options to the data owner and get them to make the call on what risk they can accept. Depending on your local laws, personal/medical data on the server may require a higher degree of protection (eg DPA in the UK, HIPAA in USA)
    – Rory Alsop
    Commented Dec 21, 2010 at 0:32

Two thoughts:

  1. Can the terminal machines communicate with each other? There might be a risk of one terminal monitoring communication of another one. There are two user accounts so there must be segregated data. The switch helps mitigate this but it can be defeated.

  2. How hard is it to hook a little pocket wifi router into the ethernet cable connected to the back of the terminals? That would give someone remote access to spend time attacking.

  • agreed - physical access to the machines (and Cisco switch even if it is not physically secured) on the network can not be underestimated since they are likely your highest IT security risk with a 100% internal network
    – August
    Commented Jan 8, 2011 at 0:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .