are VLANs sufficient to separate two LANs?

[ScottInOtt]

I work in a library. We have two, physically-separate networks: one for public use and a staff network that is used for the operation of the library. Each network has its own Internet connection. Wi-Fi connections are isolated from all other devices on the network; wired public computers only need Internet access and access to two ports on a reservation system. Network devices, such as APs and switches are on a separate management VLAN.

I want to merge the infrastructure for the two networks into a single network for unified management and sharing of specific resources, such as printers. I have a network design that partitions the network using VLANs with shared resources on a separate VLAN with very restricted routing to/from the shared resource VLAN.

My question is: if I define the VLAN at the switch port and AP, are VLANs sufficiently secure to partition my two networks? I know that "sufficiently secure" is pretty subjective, but if you have experience in this area, would you be comfortable using VLANs?

Thanks!

 

[Trip]

Hi @ScottInOtt - While VLANs will naturally create Layer 2 (MAC layer) isolation, you still need to block/permit access at Layer 3 (IP layer), between IP networks/subnets/addresses/groups, either on your router/firewall, or layer 3 switch(es) if you have one/several. For traffic that would move between VLANs, you'll want to selectively drop or accept certain kinds of traffic, networks, address groups and/or devices via ACLs on the firewall/L3 switch(es), for example, not allowing any guest wifi clients to see any of the private network, or allowing shared network resources (printers) only for specific public workstations but nothing else, etc.

All of this is fairly well Google-able/YouTube-able, so you should be able to learn up on how to configure it all without too much trial and error. Just take it slow, perhaps lab on it first, then issue config changes into production one at a time, testing as an end-user between each change.

Hope that helps!