Class B guarantee (3) - Asset survey

Table of contents

Common system deployment architecture

Three deployment modes

The management network and business network must be separated (not on the same network segment)

Management port (MGMT) (in-band management, out-of-band management)

Vrf：

Asset survey process

Common system deployment architecture

1. From single unit to multiple units

Single-server deployment (the application business system and database are placed on the same server, which is very harmful and rare now)
Separate deployment of library and site (1 application + 1 database server) (unless it is moved laterally, the harm is very small)
Separate deployment of database and site (n applications + n database servers)

2. Original network architecture (has been eliminated and is rare. The Cybersecurity Law was promulgated in 2017 and is generally a Class-A guaranteed network security architecture)

3. Class-protected network security architecture

(The core remains the same, just with additional safety equipment)

Three deployment modes

Series deployment: normal deployment mode of writing IP (the disadvantage is that there are too many network segments and resources are a bit wasteful)
Transparent deployment/bridge deployment: No IP configuration is required, similar to network cables, and does not participate in packet receiving and sending. It will only detect and intercept passing traffic (such as IPS, AV, core firewall, WAF)
Bypass deployment: No need to configure IP, the core switch is configured with a mirror port, which can only monitor traffic and has no blocking function (such as bastion host, daily review, digital review)

The management network and business network must be separated (not on the same network segment)

Management network: mainly involves the management and monitoring of network equipment, network performance and service quality. The main goal is to ensure the efficient operation of the network and to troubleshoot problems when they occur, but not to directly affect the business network.
Business network: It is a network in which organizations are connected to each other through business relationships. This kind of network is mainly for creating and exploiting business opportunities, promoting business, sharing information and finding potential business partners.

Management port (MGMT) (in-band management, out-of-band management)

(The default address is 192.168.1.1)

Out-of-band management: The management network segment does not involve business
In-band management: related to business

Addresses cannot be configured on layer 2 switches, but occasionally some devices have vlan1 (vlan1 itself). Although some IPs can be configured in vlan1, data cannot be forwarded and can only be managed.

Vrf：

Isolation of data or services is achieved by creating multiple routing tables on a layer 3 forwarding device. It is often used in MPLS VPN, firewall and other application scenarios that require isolation.