Should I use a firewall even though I am on a private vlan inside a data-center?

Question

Working on setting up some new infrastructure and I want to configure everything so that it's as secure as it needs to be, but I don't want to worry too much about adding additional unneeded complexity. Is it a good idea to firewall off private network traffic on the private interface with the data-center, or will this do no good?

The one reason I can think this would be nice is to mitigate damage, if a user gets into one server we only want them to be able to stay there and not SSH into other related servers.

Answer 1

It seems you've mostly answered your own question. The only protection a firewall can give, on an isolated network, is from computers/users of the same network. Your firewall won't protect you from Internet hackers - the isolated nature of your network already does that.

What it will protect you from is malicious users or software installed on other systems within your isolated network. As you say, this can help prevent a user on one system from connecting to other systems via SSH. It will also help protect you in the case that one of your systems gets infected with a worm which tries to automatically propagate across the network.

For the highest security, you want your systems and users to be restricted so that they are only capable of performing actions which are absolutely necessary to fulfilling their business function. Firewalls are an essential tool in implementing these restrictions, even on isolated networks. However, it is up to you to decide if the risk (e.g.: of malicious users on the network, or another system being infected with malware) is really high enough to warrant the added complexity and administrative overhead of using that tool.

Answer 2

If you can implement a firewall at a reasonable cost (in computing overhead/money spent/whatever), I think it's a good idea.

Your private VLAN's privacy is only as good as your data center's physical and information security - access to that machine may be only a single command line entry away from being exposed to others at your data center, or to the worldwide Internet.

Ideally, there would be other obstacles to access; but, especially where you don't have exclusive control of the configuration(s) of the systems that isolate you from hostile systems, and where you don't have exclusive control of the wiring (such that someone might - accidentally or on purpose - connect a machine to a port that's included in your private VLAN) - it would be nice to have another layer of protection that is within your exclusive control.