[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 473
  • Last Modified:

Network Design with excess equipment

Currently I have the following set up:
 Router>Outside-Switch>Pix515E>Proxy>Inside-Switch>LAN—
                                              |
                                    [DMZ Switch]
                                              |
                                    [4215 IDS](Only have 2 interfaces in promiscuous mode)

I would like to use the excess network devices to redesign and add a better security posture.  I have another Pix515E, IDS, and a few more switches.  This is the design that I was considering.  Please give feedback on how I can use and configure these devices in our current topology.

Router>Outside-Switch>Pix>Inside-Switch
                                     |                |
                              [DMZ-Switch]   [Pix515E]
                                 |                       |
              [WEB-Server] [IDS 4215]    [IDS 4215]
                                                             |
                                                    [Inside-Switch]
                                                               |
                                                            [LAN]
0
Jelonet
Asked:
Jelonet
4 Solutions
 
Juan OcasioApplication DeveloperCommented:
The set up looks fine just one question:  Why do you have the Inside-Switch between the Pix (what model) and Pix515E?
0
 
r_naren22atyahooCommented:
Router>Outside-Switch>Pix>Inside-Switch
                                     |                |
                              [DMZ-Switch]   [Pix515E]
                                 |                       |
              [WEB-Server] [IDS 4215]    [IDS 4215]
                                                             |
                                                    [Inside-Switch]
                                                               |
                                                            [LAN]

You would have problem with the traffice is passing via 2 PIXs
You have come accross the Double NATing and GRE protocols dont work well with Double NATting

And also you have to maintain 2 identical set of rules for inside network on 2 PIXs as the traffice is passing these 2 PIXs

regards
naren
0
 
r_naren22atyahooCommented:
I would Do some thing like this

                     Public(internet)
                             |
                           PIX_1    
                             |               }  This will be the DMZ network,Is this DMZ having Public IP address or a Private IP address
                             |               } If the DMZ has Public do the NAT on the PIX_2 else do the NAT on PIX_1
                           PIX_2
                            |
                            |
                         LAN
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
Rick HobbsRETIREDCommented:
Are the PIX515Es part of a failover bundle?  If yes I would:
                                   |Pix515E secondary|
Router>Outside-Switch>|Pix5i5E     primary|>Inside-Switch
                                     |                   |
                              [DMZ-Switch]       Proxy
                                 |                       |
              [WEB-Server] [IDS 4215]    [IDS 4215]
                                                             |
                                                    [Inside-Switch]
                                                               |
                                                            [LAN]
0
 
lrmooreCommented:
Just some comments on placing IDS outside the pix:
If everyone on the planet is knocking on the door to see what's available, then putting IDS on the outside of the PIX will bury you in looking at people that are knocking. Who cares when we all know every freak on planet earth is knocking? You time is much better spent elsewhere.
All I want to know is what is happening *inside* my network
If you don't have the 2 PIX's in failover mode, then this could be one way to add resiliency, but not *security*
You can't address *security* by doubing what you have. You address security by adding layers of defense - host based IDS, clean access, AV, inline URL filtering, written policies, user education, etc, etc..
0
 
scrathcyboyCommented:
USe the excess equipment on other networks.  One switch or router PER class C network is all you want and need, they all do stealth firewalling, so you are just giving yourself unneeded headaches by using more than one switch or router per network.
0
 
JelonetAuthor Commented:
The Pix are unrestricted.  I have seperate Pix for failover.  The inside switch is a 3650.  The DMZ addresses are public addresses.
0
 
r_naren22atyahooCommented:
Thanks, if both are 515s, use ASDM with PIX 7.1 or 7.2 , management will be easy for you!
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now