- page 64
Summary
A network management system can be more than just a tool that
The five areas for network management that provide us with the information we need are as
-
Fault management Allows us to identify and address faults that occur in the network.
-
Configuration management Allows us to increase security by ensuring the integrity and function of our device configurations.
-
Accounting management Allows us to determine what our users are doing.
-
Performance management Allows us to understand the traffic patterns and habits of our network so that we can identify exceptions much quicker and easier.
-
Security management This is the goal of this entire book. Security management allows us not only to harden the network devices
themselves , but to use those network devices to harden the infrastructure in general.
Although network management is required to effectively run a network of any
Chapter 11: Implementing a Secure Perimeter
Overview
A network is a Twinkie. I have
This chapter builds upon the device-hardening
The best methodology for hardening the perimeter that I have found is the Cisco SAFE blueprint (http://www.cisco.com/safe), and this chapter
-
DMZ implementation methods The different techniques of implementing secure access to resources in the network perimeter
-
Internet access module The collection of devices that provides Internet connectivity
-
VPN/remote access module The collection of devices that provides virtual private network (VPN) and remote access connectivity
-
WAN access module The collection of devices that provides wide area network (WAN) connectivity
-
Extranet access module The collection of devices that provides extranet connectivity to external
partners -
Wireless access module The collection of devices that provides wireless network connectivity
-
E-commerce access module The collection of devices that provides e-commerce services
DMZ Implementation
Methods
The demilitarized zone (DMZ) is a common element of most perimeter modules. In concept, the DMZ is pretty simple: you need to place a
-
Multi-
homed firewall -
Dual firewall
In addition, we ll take a look at an often raging debate in the security world: the use of virtual local area networks (VLANs) for your DMZ.
Using a
Multi-homed
Firewall for Your DMZ
Using a multi-homed firewall to create your DMZ architecture is a relatively common DMZ implementation. It is sometimes known as a DMZ on a stick. Figure 11-1 illustrates how it functions.
Traffic can pass to and from the DMZ and the Internet. Traffic can also pass to and from the DMZ and the internal network. Finally, traffic can pass from the internal network to the Internet. The most important point, however, is that no traffic can pass directly from the Internet to the internal network. Instead, those requests must all pass to a proxy in the DMZ, and the proxy can then issue the request against the internal resources on
An often overlooked aspect of DMZ filtering is the application of filtering at the external router. By implementing filtering at an external router, you can add a layer of security, ensuring that the firewall needs to concern itself only with traffic
While Figure 11-1 shows only a single DMZ, you can create additional DMZs by simply adding more interfaces to the firewall. This would allow you to create
Figure 11-1:
Multi-homed firewall DMZ without redundacy
The
Figure 11-2:
Multi-honed firewall firewall DMZ with redundancy
The benefits of this type of DMZ design are as
-
Simplicity The design is pretty simple: you add an interface to your firewall and configure it
accordingly . -
Cost This design does not require as much additional hardware as other DMZ design solutions.
|
If possible, you should use separate providers for the local loop and keep power for the primary and secondary
|
|
The primary drawback of this type of DMZ design is that you are relying on a single device, in this case the firewall, for handling all of the traffic. If the firewall can be compromised, your internal network could be left completely
|
|
When implementing firewall failover using in-
|
|
Using Dual Firewalls for Your DMZ
The use of dual firewalls is the natural progression of the router and firewall DMZ design. Through the use of dual firewalls, all of the drawbacks of the router and firewall design are mitigated. In addition, the use of dual firewalls provides even more security than any other design through the use of two different firewall
Figure 11-3:
Dual-firewall DMZ
As you can see in the figure, the DMZ is bordered by two firewalls. The first firewall protects the DMZ and internal network from Internet-based threats. The second firewall protects the internal network not only from Internet-based threats, but from any potential threats that originate from the DMZ as well. This type of system is commonly implemented with faster packet filtering or hybrid firewalls at the Internet side and more advanced application proxies or application-level gateways at the internal network side. This facilitates access to DMZ resources from the Internet while requiring a more thorough examination of data attempting to pass through to the internal network.
Like all of our DMZ designs, you can implement redundancy to provide fault tolerance, as shown in Figure 11-4.
Figure 11-4:
Dual-firewall DMZ with redundancy
The primary benefit of this type of DMZ design is security. The primary drawback is cost. As a result, dual-firewall DMZ is commonly implemented in environments where security is critical at any cost ”for example, in banking and finance organizations.
|
|
Many people think that because resources that reside in the DMZ are frequently accessed by Internet-based hosts, the resources must use real IP addresses, but this is not correct. You can implement Network Address Translation (NAT) at the firewall or routers in front of the DMZ and use private addresses on your DMZ. At that point, you can simply advertise the DMZ resources on the firewall using routable IP addresses and map those addresses back to the private addresses that the DMZ hosts are using. In fact, this is
|
|
{% if main.adsdop %}{% include 'adsenceinline.tpl' %}{% endif %}
|
|
Using a router in place of a firewall in the DMZ design is a common occurrence. The drawback of this approach is that your router isn't a firewall and generally speaking should not be used as a firewall. This type of DMZ design should not be used and should be
|
|
VLANs and DMZs
A discussion of the use of VLANs in DMZs frequently results in a heated debate. The logic is pretty sound: You have a relatively big switch and you are not using all the ports on it. You also need a few ports to create a DMZ. You have two options ”you can either buy an additional switch, which takes power, connectivity, and rack space, or you can simply create a VLAN on the switch for the ports that you want to use for the DMZ.
No good answer exists as to which solution is the best solution because best is a
I can make one recommendation, however: you should never implement VLANs on the same switch for networks with differing security levels. For example, you should never VLAN a switch between your DMZ and your internal network. This will ensure a few things. First, someone won t
When I consider whether or not to use VLANs, I tend to keep one thing in mind: the goal of a DMZ is security. Consequently, I don t want to do anything that could possibly be a security vulnerability for something for which I require stringent security. Therefore, I don t recommend using VLANs. The only way that VLAN vulnerabilities can be exploited is if you use VLANs. With the low cost of many switches today, I can t justify the security exposure for the savings that using an existing switch might provide.