0

I am currently working with a client that has all their external traffic going through the core switch and then is being passed to the router and back through the core switch and then to the rest of the network.

Diagram:

INTERNET -> coreswitch 10.1.1.1 -> internal router 10.2.2.2 -> coreswitch 10.1.1.1 -> to the rest of the network.

I am trying to convince them that they should have a firewall on the outside in front of the core switch.

I feel like I am explaining basic networking or something or basic security to them because a firewall on the outside is considered to be essential in any network.

schroeder
  • 123,438
  • 55
  • 284
  • 319
LUser
  • 824
  • 6
  • 12
  • Except maybe for the traffic going through the core switch twice. Or maybe I'm just not getting it. What is this loop good for? – Out of Band Feb 19 '18 at 17:49

1 Answers1

1

The concept is easy...think about when you travel into another country...the government inspects you (essentially) to see who you say you are and what you are planning on doing in their country. Now image if there were no customs/boarder patrol - anyone could go anywhere and could travel along pre-designed roadways & intersections (routers & switches) and you could cross boundaries like bridges (NAT) but there would be no security authority to govern what you did, where you went, and what your intents were. Basically, if you cannot inspect traffic then what good is your security?

Firewalls/UTMs (Unified Threat Management) devices are not synonymous with NAT or Routers. Yes, firewalls are security appliances & are always needed/essential at the Gateway! Their sole duty is to inspection ingress/egress traffic looking for threats and/or violations of policy. Without a firewall how would one protect against the following:

  • Encrypted payloads such as Ransomware, Zero-Day attacks
  • Rogue Services within the network such as blocking outbound DNS except for Authorized servers
  • Flood attacks
  • PoD (Ping of Death) attacks, provided you require ping for the WAN - for monitoring, etc.
  • TCP State Manipulation DoS
  • DoS (Denial of Service)
  • DNS Rebinding attacks
  • IP Spoofing attacks
  • Intrusions
  • Malware & Spyware
  • Botnets attacks
  • Geo-IP attacks
  • Content-related attacks from the LAN (HTTP Proxy, Avoidance Systems)
  • Application behavior & control in all Zones - being able to thwart SSLv2, SSLv3, SSLv3.1/TLS1.0 traffic, stopping specific applications outside of your Authorized App Library

You need a firewall to provide inspection as a security baseline, which should include at the very, very minimum DPI (Deep Packet Inspection) & SSL-DPI (encrypted packets). Routers & switches were never designed to be security appliances with the capabilities to perform in this manner and neither was NAT.

Blue Street
  • 26
  • 2