Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Tunneling in DMZ or begind firewall

Posted on 2014-03-31
4
Medium Priority
?
479 Views
Last Modified: 2014-04-01
Is there a good reason to provide tunneling within the DMZ vs. begind the firewall.

In one scenario, you would wrap and unwrap packets within the DMZ (probably from a proxy), and in another scenario you would do it at the application level behind the firewall

Which would be more secure?

njd
0
Comment
Question by:Anthony Lucia
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 39969006
It depends on how you're measuring security. In a sense encapsulating / tunnelling between two end-points is the most secure. That could well be handled at application level. Whether it's actually more secure or not is a matter of trust and how you're tunnelling.  That is:

Do you trust the network (and all services) between two end-points? Are sufficient security controls in place to protect information in transit?
Do you really need to tunnel? This is  where we'd consider encapsulating an entire IP packet.
Is payload encryption (such as SSL) sufficient? Or does does the content of the IP header need to be encrypted as well?

While it's implied in your question, tunnelling does not necessarily mean you're encrypting. Tunnelling on it's own may simply be used as a means to carry one protocol across another.

GRE (Generic Router Encapsulation) tunnelling is a good example of this, it doesn't encrypt the original payload, it simply wraps it up so you can get it from A to B without the path between needing to know about the thing you're attempting to transmit.

A number of technologies are available to both encapsulate and encrypt data in transport. A couple of popular examples include:

IPSEC VPN tunnels - Both L2L (LAN to LAN) and client to LAN.
SSH tunnels  - Uses public / private key cryptography to encrypt everything inside the SSH tunnel.

There are, of course, many other protocols which can be used to tunnel (both with and without encryption). Suitability depends on your goals and the reason for your question in the first place.

Chris
0
 
LVL 64

Expert Comment

by:btan
ID: 39969012
It brings back to principle of detecting at the earliest for any malicious content in the traffic. I was thinking of probably 3 main use case

Case 1 - If we are talking about traditional FW, IP and Port are at most what they can check based on rule so tunneling of the content will make no differences. The traffic such as SSL will pass in and even bypass the IPS or web appl FW unless termination or interception is configured. We should at best do it earliest as another layer before reaching the server end.

Case 2 - If we are talking about NG FW or UTM, content inspection is one area they can inspect further including at application level. Tunneling such as VPN and SSL in common should be terminated or intercepted at this end to inspect before granting the traffic inwards further.

Case 3 - If tunneling is allowed through till the server, it leaves with HIPS in the server to (hopefully) detect the threats incoming, if any. This should be the last line of defence assuming the threat is real, and I do not advocate always relying on that defence and layering is better deterrence scheme instead. Having said that, there is still possibility that (1) and (2) can be somehow bypass/evaded, but we leave it to circumstances such as patch/signature delays, insider, misconfiguration and zero day threats instead of intended tunneling.

Note that the above is assuming inbound traffic we should not ignore outbound too, esp if there is reverse tunneling type or reverse shell type (where the connection is initiated from internal to make it legit and pass the ruleset). Inspection should likewise cater for that. Key is that for all tunneling if there are anomalous tunnel protocol establishment attempts, it should sound the alert aloud (and secure by default, deny that)
0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 1000 total points
ID: 39969024
Agreed, tunnelling (with encryption) between endpoints tends to act against a defence-in-depth model. The two end-points may (potentially) be the only entities able to consider the actual payload unless you decrypt / re-encrypt somewhere else in the network path.

It's very subjective which is why I start with "it depends" :)

Chris
0
 
LVL 64

Accepted Solution

by:
btan earned 1000 total points
ID: 39969062
In the same page. Back to Business call as they are pay owner and their risk appetite. This can be "big" concern if the device or checks are via cloud service host provider - some will not want to "decrypt" for their inspection, but who know they will have already means to "see" what they are supposed not to see :)
0

Featured Post

Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Check out the latest tech news, community articles, and expert highlights in August's newsletter.
What we learned in Webroot's webinar on multi-vector protection.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

704 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question