Securing a VPN connection

Question

I'm new to this we want to install a new VPN connection that will be used to connect using Internet to some networks in the office the contractor want to use a" Cisco NAC Network Module or Cisco IPS AIM and IPS NME " -- I really don't know what he is talking about --

This is a server farm network and there will be 2 VPN connection to communicate with 2 server farm separately

I want to install a firewall but I wanna know how its going to help me securing the connection

Can you please tell me what the firewall in this case should be configured to do?

Answer 1

Firstly, firewall is not a magic word: simply installing one at random without a clear idea of what you want it to do is not going to help.

Secondly, neither NAC nor IPS are VPN solutions, so you need your contractor to explain her recommendations again.

More generally, firewalls used in conjunction with a VPN are normally designed to restrict what the VPNed in user can access on your internal network. By default a VPN connects a remote user over the public Internet to your internal network, giving them the exact same access as if they came into your server farm and connected their machine there.

Sometimes you want people coming in via VPN to have less than total access to the internal network: you do this by putting a firewall between the VPN connections and the rest of the network.

In this way you can define firewall rules such as "if someone comes in over VPN, only allow them access to servers A, B, and C, and nothing else."

Answer 2

As Graham properly pointed out, firewall isn't a "magic word" that'll secure your systems.

Allow me to elaborate. I'm going ahead on the assumption that you've got multiple data centers containing systems that you want to hotlink on an internal network. That's what you'll be using a VPN (Virtual Private Network) for (ie. to connect all your systems on an internal private non-physical network) .

A firewall is simply a program that filters incoming and outgoing traffic from different programs. It helps secure your systems because it ensures that only authorized traffic goes through (like security checks in an airport).

My point is that, a firewall needs appropriate rules to be setup before it can be of any use. More on, any mistake in these rules will lead to a security vulnerability.

Furthermore, firewalls in case of VPNs slightly complicate things, because you need to filter not only the traffic coming from the internet but also internal. A good example of this is if you do not have a properly setup firewall internally, then you will be vulnerable to attacks coming from any servers inside your internal network (any compromised servers or servers being used for malicious intent).

---

What you need to ensure in a nut shell:

1. Ask your network administrator to lay out a list of TCP and UDP ports that cannot be blocked or are essential for your server to run.
2. Get your engineer to setup the firewall based on these requirements.
3. Then get a security professional to give you a network vulnerability assessment report for any possible problems in the setup of the firewall to ensure all's good. :)

---

"The Cisco Intrusion Prevention System Advanced Integration Module (IPS AIM) and Network Module Enhanced (IPS NME) bring integrated intrusion prevention to enterprise branch offices."

Essentially it is a simpler to implement program that tries to do the job of a firewall. An IPS or IDS (Intrusion Prevention/Detection System) at a most primitive and basic level do the job of evaluating any input or traffic for particular signatures, etc that may indicate unauthorized use or maliciousness intent. They're good because the signature comes built in. Such security solutions are widely acknowledged in banks are other high security sections, and thus are more than good for a data center. They're also debatable easier to setup then a firewall.

But at a higher level of knowledge, a firewall is generally based on a policy that says, "Only allow Apache and MySQL to take and send traffic." while an IDS uses checks such as "If Apache is sending traffic, is the traffic it is receiving and sending malicious."

• Eg. A IDS will stop a SQL Injection Vulnerability, a firewall will not.
• Eg. A firewall will stop a reverse tcp shell from giving a hacker remote access while an IDS may not.

As per my understanding of security, you will need both, a well configured firewall and a good IDS/IPS.

I hope I was able to do justice to your question. Please comment any doubts or feedback on my answer.