Solved

NBAR + Policy Routing?

Posted on 2003-11-24
1
433 Views
Last Modified: 2008-01-16
Here's the scenario:

A site in <faraway country> is connected to our headquarters via frame relay, and is supposed to use our Internet access due to the security requirements of having a full-blown DMZ, content blocking system, etc.  These standards are non-negotiable and would cost far too much to deploy at this remote location.  However, they have a few business-related sites (banks, mainly) that are located in the same country that they need to access regularly.  Since Internet traffic is currently going across the ocean several times, it's causing their sessions to time out, which is obviously not good.
 
So, given a (NAT-ed) link to a local ISP (on an interface running IOS firewall and generally locked down as much as possible, it seems that I have two options:

1. Figure out all the IPs/subnets involved with the bank sites and statically route them out the local ISP port.
2. Use NBAR to identify the relevant traffic and policy route it out the local ISP port.

Option 1 is obviously simpler in a way, but seems like it could end up being a hassle and possibly be hard to maintain since the banks are under no obligation to keep their IPs static.  So my question is, how feasible would Option 2 be?  I've worked with policy routing before, but not for this kind of problem, and I've never used NBAR at all.  Besides the "can this work" question, I'm wondering how badly this is going to kill a low-to-mid-range router to do the extra work involved.
0
Comment
Question by:MaxQ
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 18

Accepted Solution

by:
chicagoan earned 500 total points
ID: 9812891
I think option 1 is reasonable, large institutions rarely change netblocks, though this doesn't protect you alone, there's no guarantee they don't have problems, but combined with PAT, sensible filters (IOS firewall features?) and syslog inspection, ought to be adequate and defensible in terms of due dilligence.

while NBAR is supported on 1700's and up last i looked, it seems like overkill here and I believe will be a lot more labor if you don't need traffic shaping, etc. whether it would be a drag on resources depends on the policies and traffic. On a 3600 and a T1 you'd probably be OK
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question