VLAN Security

[Guest Mark Sassman]

I have a network with servers and desktops that I want to put on one vlan

segment, and laptops on a seperate vlan. I have seperate security zones on

the router for laptops and desktops. Laptops are used with full admin rights,

so my concern is a laptop infecting the rest of the network. I would like to

open ports between the 2 security zones for file sharing, exchange email,

antivirus updates, etc. My question is, if I open ports for these functions,

am I defeating the purpose of segregating my networks.