Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
By using a Proxy Server like 'Cisco WSA' the end user does not need to know where a web service like facebook.com lives, the end user just makes a request to a proxy server and it does the work of locating the web service. With this action our LAN does not know any public IP address, only our private IP address.
Can somebody tell me what are the disadvantages of public IP addresses (web server like facebook.com) visible on our LAN?
The advantage of a proxy is not primarily that public IP are not visible on the internal LAN, but hat you have a better control of what the clients can do and what not. Just some examples to illustrate the advantage of explicit proxies:
With an explicit proxy you can enforce proper authentication at the proxy, which means that you know which user is connecting. This way you can enforce user-specific policies, do user-specific logging etc. Without an explicit proxy you usually somehow associate the IP address of the client with a specific user which only works when each user has its own internal IP address (i.e. not with terminal servers or similar).
With a explicit proxy requests for all of http://example.com/, http://example.com:8080 or http://example.com:8000 will be sent directly to the proxy and the proxy will connect to the given ports (80, 8080, 8000). Without such explicit proxy inspecting the traffic for malware etc is much harder. In effect you would need to have port independent filters like offered by some next generation firewalls. But these port independent filters are known to have problems, i.e. the firewall can often be tricked into assuming the wrong protocol and thus uses the wrong inspection.
A common way to bypass "transparent" inspection is to send contradictory information. For instance if a firewall should block bad-site but should allow good-site one might try to set the Host header in the HTTP request to good-site but then connect to the IP address of bad-site. Lots of web servers don't check the host header at all and thus bad-site would serve the content even if the Host header does not match.
A typical transparent inspection looks only at the Host header and decide that the request can pass because according to the Host header the target is good-site. An explicit proxy instead gets the full URL, applies the policy to the URL and only if the policy allows access it continues with connecting to the given host, i.e. the target IP address is determined by the proxy and not the browser.
If a browser is configured to do all requests through a proxy than the proxy could be used to separate internal and external sites. I.e. it could either deny access to internal sites or at least restrict cross-origin requests from external to internal sites and thus protect against typical Web 2.0 attacks from outside (CSRF, XSS, DNS rebinding...).
