Field note / 16 January 2012
Subnets and VLANs for simple SharePoint network isolation
Segmentation is a security and operations tool. It becomes useful when the rules are drawn as clearly as the diagram.
A SharePoint farm often has several network roles: users, administration, storage and service traffic. Putting everything on one flat network is simple until a broadcast storm, a scan or an unexpected route turns the whole farm into one failure domain.
Subnets and VLANs create boundaries. They do not create policy by themselves. The routing and firewall rules between those boundaries determine whether the design improves security or merely moves the complexity.
Draw the flow before the address plan
List each traffic type and where it must go. Then assign addresses and tags that make the role obvious. Administrative traffic should not share a path with general user access if the organisation can support a separate route. Storage traffic should be deliberate, not accidental.
Test name resolution across the boundaries. Many segmentation projects fail at DNS or at a firewall rule that allows the first connection but not the callback. Document the required ports and the owner of each rule so a later change does not silently break the farm.
The short list
Checks worth running
- Map each traffic type to its source, destination and required ports.
- Verify DNS and routing from every network segment.
- Assign an owner and review date to each firewall rule.
A good network plan is readable. Someone should be able to look at the diagram and understand not only where a packet goes, but why the boundary exists.
Outside reading
Reference shelf
Official documentation and independent community reading for the subjects in this note.
- Microsoft Learn: Windows Server documentation (opens in a new tab)Current guidance for Windows Server roles, networking, storage and management.
- Microsoft Learn: Hyper V on Windows (opens in a new tab)Documentation for virtual machines, virtual switches and host configuration.
- Microsoft Learn: IIS documentation (opens in a new tab)Reference material for web server configuration, authentication and diagnostics.
- Microsoft Support (opens in a new tab)Support articles, troubleshooting steps and product help from Microsoft.
- Microsoft Learn: SharePoint administration (opens in a new tab)Operational guidance for service settings, site management and the modern admin experience.
- Microsoft Tech Community (opens in a new tab)Community discussion, product announcements and practical posts from Microsoft teams.
- Microsoft Learn Q&A (opens in a new tab)A community question and answer space hosted by Microsoft.
- SharePoint Stack Exchange (opens in a new tab)An independent question and answer community for SharePoint practitioners.
- Microsoft Learn: Azure Architecture Center (opens in a new tab)Reference architectures and design guidance for resilient cloud workloads.
- Microsoft Download Center (opens in a new tab)Official downloads for Microsoft tools, updates and supporting packages.
- Microsoft Security blog (opens in a new tab)Microsoft guidance on security research, response and platform protection.
- Microsoft Security Response Center (opens in a new tab)Security advisories, update guidance and vulnerability response information.
- Microsoft Learn: SharePoint documentation (opens in a new tab)The starting point for current SharePoint administration, development and hybrid guidance.
- Microsoft Learn: SharePoint search (opens in a new tab)Documentation for search architecture, crawling and result management.
- Microsoft Learn: PowerShell documentation (opens in a new tab)Language reference, cmdlet documentation and guidance for repeatable automation.