?
Solved

Network Design with excess equipment

Posted on 2006-07-17
8
Medium Priority
?
469 Views
Last Modified: 2010-03-19
Currently I have the following set up:
 Router>Outside-Switch>Pix515E>Proxy>Inside-Switch>LAN—
                                              |
                                    [DMZ Switch]
                                              |
                                    [4215 IDS](Only have 2 interfaces in promiscuous mode)

I would like to use the excess network devices to redesign and add a better security posture.  I have another Pix515E, IDS, and a few more switches.  This is the design that I was considering.  Please give feedback on how I can use and configure these devices in our current topology.

Router>Outside-Switch>Pix>Inside-Switch
                                     |                |
                              [DMZ-Switch]   [Pix515E]
                                 |                       |
              [WEB-Server] [IDS 4215]    [IDS 4215]
                                                             |
                                                    [Inside-Switch]
                                                               |
                                                            [LAN]
0
Comment
Question by:Jelonet
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 14

Assisted Solution

by:Juan Ocasio
Juan Ocasio earned 200 total points
ID: 17126471
The set up looks fine just one question:  Why do you have the Inside-Switch between the Pix (what model) and Pix515E?
0
 
LVL 12

Expert Comment

by:r_naren22atyahoo
ID: 17126781
Router>Outside-Switch>Pix>Inside-Switch
                                     |                |
                              [DMZ-Switch]   [Pix515E]
                                 |                       |
              [WEB-Server] [IDS 4215]    [IDS 4215]
                                                             |
                                                    [Inside-Switch]
                                                               |
                                                            [LAN]

You would have problem with the traffice is passing via 2 PIXs
You have come accross the Double NATing and GRE protocols dont work well with Double NATting

And also you have to maintain 2 identical set of rules for inside network on 2 PIXs as the traffice is passing these 2 PIXs

regards
naren
0
 
LVL 12

Accepted Solution

by:
r_naren22atyahoo earned 800 total points
ID: 17126799
I would Do some thing like this

                     Public(internet)
                             |
                           PIX_1    
                             |               }  This will be the DMZ network,Is this DMZ having Public IP address or a Private IP address
                             |               } If the DMZ has Public do the NAT on the PIX_2 else do the NAT on PIX_1
                           PIX_2
                            |
                            |
                         LAN
0
Need protection from advanced malware attacks?

Look no further than WatchGuard's Total Security Suite, providing defense in depth against today's most headlining attacks like Petya 2.0 and WannaCry. Keep your organization out of the news with protection from known and unknown threats.

 
LVL 22

Expert Comment

by:Rick Hobbs
ID: 17126919
Are the PIX515Es part of a failover bundle?  If yes I would:
                                   |Pix515E secondary|
Router>Outside-Switch>|Pix5i5E     primary|>Inside-Switch
                                     |                   |
                              [DMZ-Switch]       Proxy
                                 |                       |
              [WEB-Server] [IDS 4215]    [IDS 4215]
                                                             |
                                                    [Inside-Switch]
                                                               |
                                                            [LAN]
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 800 total points
ID: 17127325
Just some comments on placing IDS outside the pix:
If everyone on the planet is knocking on the door to see what's available, then putting IDS on the outside of the PIX will bury you in looking at people that are knocking. Who cares when we all know every freak on planet earth is knocking? You time is much better spent elsewhere.
All I want to know is what is happening *inside* my network
If you don't have the 2 PIX's in failover mode, then this could be one way to add resiliency, but not *security*
You can't address *security* by doubing what you have. You address security by adding layers of defense - host based IDS, clean access, AV, inline URL filtering, written policies, user education, etc, etc..
0
 
LVL 44

Assisted Solution

by:scrathcyboy
scrathcyboy earned 200 total points
ID: 17127903
USe the excess equipment on other networks.  One switch or router PER class C network is all you want and need, they all do stealth firewalling, so you are just giving yourself unneeded headaches by using more than one switch or router per network.
0
 

Author Comment

by:Jelonet
ID: 17128938
The Pix are unrestricted.  I have seperate Pix for failover.  The inside switch is a 3650.  The DMZ addresses are public addresses.
0
 
LVL 12

Expert Comment

by:r_naren22atyahoo
ID: 17135007
Thanks, if both are 515s, use ASDM with PIX 7.1 or 7.2 , management will be easy for you!
0

Featured Post

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question