Advertisement
- Home
- Security
- Vulnerabilities
- Networking:Internet Edge Security Design
Advertisement
- 1. rpggamer... 40,008
- 2. IndiGenus 36,230
- 3. jahboite 26,169
- 4. r-k 19,590
- 5. arnold 10,150
- 6. nsx106052 9,825
- 7. richrumble 7,050
- 8. briancassin 7,000
- 9. ahoffmann 6,907
- 10. PowerIT 6,400
- 11. tigermatt 6,148
- 12. johnb6767 5,600
- 13. KCTS 5,500
- 14. rindi 5,350
- 15. paradoxe... 5,300
- 1. rpggamer... 152,133
- 2. r-k 100,837
- 3. Sheharya... 88,781
- 4. IndiGenus 58,470
- 5. war1 45,835
- 6. blue_zee 39,997
- 7. sunray_2003 39,840
- 8. jahboite 32,113
- 9. ghana 29,660
- 10. Tolomir 29,508
- 11. rossfingal 27,308
- 12. johnb6767 22,034
- 13. ahoffmann 20,357
- 14. PowerIT 19,977
- 15. LucF 17,713
| 05.06.2008 at 12:34AM PDT, ID: 23378694 |
|
[x]
Attachment Details
|
||
|
[x]
The Solution Rating System
|
||
|
With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.
Your Input Matters If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support. Thank you! |
||
Networking:Internet Edge Security Design
Tags:
Networking:Internet Edge Security Design
Q:
in a DC, Our contractor implement this(see attachment) plan for Internet Edge of the DC:two redundant cisco routers connect two ISP, these routers connect to two redundant(active-passive HA) UTM(clavister SG3150) as fullmesh, the UTMs connect(fullmesh) to two Firewall(ISG2000) for Trusted zone access.
For HA configuration, the ClavisterSGs through a two redundant cisco switches connect two each other and to the routers, also through other two switch connect to the ISGs for HA.
Please, give me a security analys and possible security hols( threatments) of this plan.
Thanks
in a DC, Our contractor implement this(see attachment) plan for Internet Edge of the DC:two redundant cisco routers connect two ISP, these routers connect to two redundant(active-passive HA) UTM(clavister SG3150) as fullmesh, the UTMs connect(fullmesh) to two Firewall(ISG2000) for Trusted zone access.
For HA configuration, the ClavisterSGs through a two redundant cisco switches connect two each other and to the routers, also through other two switch connect to the ISGs for HA.
Please, give me a security analys and possible security hols( threatments) of this plan.
Thanks
Attachments:
Question Stats
Zone:
Security
Question Asked By:
yamahdi
Solution Provided By:
richrumble
Participating Experts:
1
Solution Grade:
A
Views:
5
Translate:
Loading Advertisement...
Loading Advertisement...
| Microsoft |
- Internet Protocols
- Applications
- Development
- OS
- Hardware
- Windows Security
| Apple |
- Operating Systems
- Hardware
- Programming
- Networking
- Software
| Internet |
- Search Engines
- File Sharing
- WebTrends / Stats
- Spy / Ad Blockers
- Web Browsers
- New Net Users
- Web Development
- Chat / IM
- Anti Spam
- Web Servers
- Anti-Virus
- Email Clients
| Gamers |
- Tips
- Online / MMORPG
- Puzzle
- Emulators
- Action / Adventure
- Role Playing
- Consoles
- Game Programming
- Strategy
- Sports
- Misc
- Computer Games
| Digital Living |
- Hardware
- Automotive
- New Net Users
- New Users
- Software
- Digital Music
- Gaming World
- Home Security
- Apple
- Networking Hardware
| Virus & Spyware |
- Vulnerabilities
- IDS
- Encryption
- Anti-Virus
- Operating Systems Security
- Software Firewalls
- WebApplications
- Cell Phones
- Operating Systems
- Internet
- Hardware Firewalls
| Hardware |
- Displays / Monitors
- Handhelds / PDAs
- Components
- Peripherals
- Laptops/Notebooks
- Servers
- Misc
- Apple
- Embedded Hardware
- Networking Hardware
- Storage
- Desktops
- New Users
| Software |
- System Utilities
- Industry Specific
- Network Management
- Photos / Graphics
- Page Layout
- VMware
- Misc
- Web Development
- OS
- CYGWIN
- Voice Recognition
- Virtualization
- Message Queue
- Quality Assurance
- Security
- Firewalls
- MultiMedia Applications
- Development
- Database
- Office / Productivity
- Business Management
- OS/2 Apps
- Server Software
- Internet / Email
| ITPro |
- OS
- Storage
- Encryption
- Operating Systems Security
- Apple Hardware
- Laptops & Notebooks
- Servers
- Networking Hardware
- Peripherals
- Devices
- Displays / Monitors
- WebTrends / Stats
- Search Engines
- Firewalls
- Web Computing
- WebApplications
- IDS
- Vulnerabilities
- Email Clients
- File Sharing
- Spy / Ad Blockers
- Web Browsers
- Web Servers
- Networking
- Anti-Virus
- Consulting
- Chat / IM
- Anti Spam
| Developer |
- Web Servers
- Web Browsers
- Game Programming
- Dev Tools
- Industry Specific
- Office / Productivity
- Database
- CYGWIN
- Web Development
- Search Engines
- File Sharing
- WebTrends / Stats
- Programming
- Content Management
- Application Servers
- Protocols
| Storage |
- Removable Backup Media
- Storage Technology
- Servers
- Grid
- Remote Access
- Backup / Restore
- Misc
- Hard Drives
| OS |
- Miscellaneous
- Security
- Development
- Linux
- VMware
- MainFrame OS
- Unix
- Apple
- OS / 2
- AS / 400
- BeOS
- Microsoft
- VMS / OpenVMS
| Database |
- Oracle
- Miscellaneous
- MySQL
- Software
- Sybase
- Contact Management
- PostgreSQL
- Data Manipulation
- Clarion
- InterSystems Cache
- Siebel
- MUMPS
- OLAP
- SQLBase
- SAS
- GIS & GPS
- 4GL
- Berkeley DB
- DB2
- Informix
- Interbase / Firebird
- FoxPro
- Reporting
- LDAP
- Filemaker Pro
- MS SQL Server
- dBase
- MS Access
| Security |
- Misc
- Web Browsers
- Software Firewalls
- Operating Systems Security
- File Sharing
- Spy / Ad Blockers
- Vulnerabilities
- WebApplications
- IDS
- Anti-Virus
- Encryption
- Anti Spam
- Email Clients
- VPN
- Chat / IM
| Programming |
- Editors IDEs
- Installation
- Handhelds / PDAs
- Multimedia Programming
- System / Kernel
- Automation
- Algorithms
- Game
- Signal Processing
- Project Management
- Open Source
- Database
- Misc
- Languages
- Processor Platforms
- Theory
| Web Development |
- Scripting
- Blogs
- Web Servers
- Software
- Search Engines
- Web Graphics
- Web Services
- Images
- Internet Marketing
- Images and Photos
- Components
- Document Imaging
- Web Languages/Standards
- Illustration
- WebApplications
- Fonts
- WebTrends / Stats
- Authoring
- Digital Camera Software
- Miscellaneous
| Networking |
- Protocols
- Apple Networking
- Network Management
- Message Queue
- Application Servers
- Content Management
- File Servers
- Email Servers
- Misc
- Java Editors & IDEs
- Wireless
- Networking Hardware
- Backup / Restore
- System Utilities
- ISPs & Hosting
- Web Servers
- Storage Technology
- Removable Backup Media
- Servers
- Web Computing
- Broadband
- Grid
- OS / 2
- Novell Netware
- Unix Networking
- Windows Networking
- Security
- Telecommunications
- Operating Systems
- Linux Networking
| Other |
- Lounge
- Business Travel
- Community Support
- New Net Users
- Philosophy / Religion
- Math / Science
- Miscellaneous
- URLs
- Expert Lounge
- Politics
- Puzzles / Riddles
- Automotive
| Community Support |
- Suggestions
- New to EE
- New Topics
- CleanUp
- Announcements
- General
- Feedback
- Input
- EE Bugs
| 05.08.2008 at 07:01AM PDT, ID: 21524746 |
The physical configuration is just about perfect, it's your (software)config that would need to be questioned... No need to post it here, but there are basics standards to adhere to.
Ingress filters, incoming ports and sources. Limit your exposure as much as possible, if you have SQL servers for example exposed to the internet, create an ACL that limits who can access them. Or maybe VNC or RDP is a better example. If you can get by using a VPN connection to access servers then do that rather than expose them to the internet if you cannot apply a restrictive ACL.
Egress Filters: Filtering outgoing/destination ports. If your users have no reason to upload files to the internet via FTP, block DST port 21 for your user subnet. Things like that.
Invalid traffic: Add blocks for RFC 1918 ip space on your inbound public IP's, block 10.x.x.x, 192.168.x.x etc... Also block spoofed/invalid packets that claim to be from your internal network to your public network:
http://www.cisco.com/warp/
Also make sure your BGP peers are using MD5 hash to verify your peer: http://bgphints.ruud.org/a
keep your edge routers and other hardware updated with patches or operating system upgrades. You may also want to impliment an IDS system like Snort on the inside of your lan, it's not as necessary on the outside, and it will be far more chatty on the outside, your ACL's should block most of the bad stuff it would pick up. On the inside however, your seeing only what actually does get through, which is a better way to see such data.
-rich
Ingress filters, incoming ports and sources. Limit your exposure as much as possible, if you have SQL servers for example exposed to the internet, create an ACL that limits who can access them. Or maybe VNC or RDP is a better example. If you can get by using a VPN connection to access servers then do that rather than expose them to the internet if you cannot apply a restrictive ACL.
Egress Filters: Filtering outgoing/destination ports. If your users have no reason to upload files to the internet via FTP, block DST port 21 for your user subnet. Things like that.
Invalid traffic: Add blocks for RFC 1918 ip space on your inbound public IP's, block 10.x.x.x, 192.168.x.x etc... Also block spoofed/invalid packets that claim to be from your internal network to your public network:
http://www.cisco.com/warp/
Also make sure your BGP peers are using MD5 hash to verify your peer: http://bgphints.ruud.org/a
keep your edge routers and other hardware updated with patches or operating system upgrades. You may also want to impliment an IDS system like Snort on the inside of your lan, it's not as necessary on the outside, and it will be far more chatty on the outside, your ACL's should block most of the bad stuff it would pick up. On the inside however, your seeing only what actually does get through, which is a better way to see such data.
-rich
| 05.08.2008 at 10:44PM PDT, ID: 21530588 |
dear richrumble
thanks for your help,
I understand what you say and accept all, but I have another question:
I upset about two routers used in internet edge, if these routers are not hole security such as DOS attacks?, and is it necessary to use a security device such as IPS(the IPS that support routing protocols-OSPF,BGP-) instead of these routers?
Thanks a lot.
thanks for your help,
I understand what you say and accept all, but I have another question:
I upset about two routers used in internet edge, if these routers are not hole security such as DOS attacks?, and is it necessary to use a security device such as IPS(the IPS that support routing protocols-OSPF,BGP-) instead of these routers?
Thanks a lot.
| 05.09.2008 at 05:07AM PDT, ID: 21531918 |
You can go that route, having your IPS in front of the routers. A DDOS isn't really a security hole, it's possible problem you could face, but it takes more than your equipment for deal with a DDOS, it takes to colaboration of your ISP/BGP peers and probably their peers.
http://www.cisco.com/en/US
http://www.counterpane.com
http://www.sans.org/readin
Having two routers, and hopefully two different circuit providers, or more if possible, can and will help you to change your routing and lessen the impact of the ddos. The DDOS shouldn't affect your routing if your using a hash with your ISP peers as I outlined above. If your doing that, your main worry is circuit saturation from the DOS.
-rich
http://www.cisco.com/en/US
http://www.counterpane.com
http://www.sans.org/readin
Having two routers, and hopefully two different circuit providers, or more if possible, can and will help you to change your routing and lessen the impact of the ddos. The DDOS shouldn't affect your routing if your using a hash with your ISP peers as I outlined above. If your doing that, your main worry is circuit saturation from the DOS.
-rich
Accepted Solution
20080236-EE-VQP-29 / EE_QW_2_20070628
