Public DMZ network architecture

Question

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one:

Now that I got employed, my boss, a security engineer with 10+ years of experience has a different point of view. For him, a DMZ should not be placed in a "sandwich" between the LAN and internet. Instead, it should be like the one illustrated below:

When searching with Google for network architectures with a DMZ, I found different representations and I got even more confused. So my question is, how should a DMZ be placed in a highly secure network architecture? Is the first representation OK from a security point of view?

Answer 1

The two are functionally equivalent - the DMZ is effectively in a sandwich, as it has to have connections from the outside world firewalled, but also have firewalls restricting access from it to the internal network.

While the latter diagram is often what happens (for cost reasons - you need less firewalls) the first one is considered safer as you can use two different makes of firewall, which helps avoid an attack on the firewall breaching both of them. Where you use one firewall, you use sets of rules for each direction and each connection - and functionally this is the same as the sets of rules in the second example.

This is just a slight improvement in security, as generally you don't attack the firewalls - you use the open ports to go straight through and attack the webserver, mailserver, or even pass straight through to attack the database, but layers of security all help.

Answer 2

How should a DMZ be placed in a highly secure network architecture?

The key is defense in depth between security domains. The extent of the deployed architecture will be dependant on the resources available, including financial limitations and technical capabilities.

Defense in depth

Defense in depth is an information assurance (IA) concept in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. It is a layering tactic, to mitigate the consequence of a single security control failing. Wikipedia

Security domains

A security domain is the determining factor in the classification of an enclave of servers/computers. A network with a different security domain is kept separate from other networks. Wikipedia

Implementation

For the purposes of determining controls between security domains you could define; the internet as untrusted, the DMZ as semi-trusted, and internal networks as trusted.

Therefore, you would employ multiple layers of security controls between the internet and your DMZ, which could include: L3 firewalls, IPS, AV, Reverse-proxy/Load-balancing, L7 filtering.

From the DMZ host(s) back to your internal network, you would employ additional layers of: L3 firewalls, L7 filtering (e.g. RPC), IPS/AV.

Least privilege access between security domains is also key to maximise the effectiveness of the security controls.

---

Is the first representation OK from a security point of view?

I would advise no, due to a lack of defence in depth. There is only a single access control between the Internet-DMZ, and DMZ-LAN. Typically a highly secure architecture would have vendor-separation, and layers of access controls (L3 FW, WAF, IPS, AV, etc).

Answer 3

There are absolutely no absolutes in security.

From a training perspective - I'd say the first is more clear. It shows the concept that the outside world goes through these various layers and that it's easier to hit the DMZ and presumably what's stationed there is lower risk.

It's also better from a layered defense point of view - as pointed out in other answers very nicely.

But it's less pratical from a cost point of view. And I've seen many, many variants on the lower diagram - all segmenting networks for various reasons, trying to do more with less for various cost or other practical reasons.

I don't honestly believe there is a "right way" or a "right diagram". Factors include:

• cost vs. risk tradeoff - multiple layers of firewalls with diverse vendors is definitely more secure, it's also more expensive. A must have for a high value/high risk operation. Overkill for a low value/low risk operation - as it's not only expensive to purchase, but also to maintain, and you have to weigh the factor of humans maintaining these things, and the risk of gaps and misconfigurations. One well configured firewall is going to be better than two firewalls that are wide open because the person configuring them didn't know enough to do the job right!

• clarity - what does the network really look like? If there's just one firewall, please draw the diagram accordingly, don't leave people hunting for a second firewall. Unless you are talking about a logical layer and not a physical layer, in which case both "walls" may be on the same device. The point of a diagram is to help humans do things... a diagram is "right" or "wrong" only in terms of its ability to fulfill this need.

I'd say, if your boss is claiming that his drawing is the absolute "right way" - he's out of his mind... there's plenty of public examples to counter that.

If it's the clearest way to describe the thing you are working with, then he's right.

Answer 4

I'll repeat some things others have said, but here it goes.

First of all, I'd think about how much security is desired, the cost to achieve it, and the problems that will arise if something fails and the comunication is lost between the secure-zone and the internet.

Your cenario looks a bit more sofisticated, because there are more layers from the dark-world until your secret data is reached. But it also adds more costs, more points-of-failure exists.

The second cenario is as-secure-as the firewall is. Getting the DMZ compromised won't make it easier to attack, since it has to go through the firewall, and the firewall is the piece of resistance in all the concept.

And sorry, but if the question was only about "which one is correct: two firewalls or a single one?", I couldn't find any reference to decide it.

Answer 5

I am not clear on what you mean by a "highly secure network architecture". You would need to consider in more detail what are your security objectives, information security requirements and the threats landscape in which you are evolving to design and implement appropriate security controls.

I will however try to answer your question at a high level.

Yes, the first security architecture is OK from a security point of view in general. There are variations of this architecture (e.g. do you attach the DMZ to the external and/or internal firewalls and/or in-between) but I do not believe it is relevant to your question at this stage.

My understanding is that this architecture used to be more popular at a time when firewalls had multiple known public vulnerabilities in their implementation that would permit to bypass or even exploitation of the firewalls themselves and in the absence of other mitigating controls.

In using a different implementation for your external and internal firewalls, you are just applying the principle of natural selection to your architecture and it is generally a good thing: if one implementation is vulnerable to a specific attack, the same attack may not work on a different implementation if their respective traits are dissimilar enough. You are hopefully removing a single point of failure (from an implementation perspective) of the "firewall security function".

Of course, depending of your information availability requirements, you may need to consider clustering your external and internal firewalls among other things.

The second architecture is also valid from a security perspective and I believe it is now more popular than the first one (cost helping). You have a potential single point of failure of the firewall security function. However, most organisations would have (hopefully) realised by now that you cannot rely on your firewall only to provide security services. Routers/switches/host firewalls/etc. can all contribute to the security posture of an organisation thus mitigating some or all the damage caused by a compromise of a (single) firewall implementation. It also appears that firewalls are a bit more solid nowadays and that attacks have shifted to higher but softer OSI layers e.g. applications.

I would consider the second architecture for most deployments. I may consider the first architecture in some specific circumstances including but not limited to security objectives and requirements, potential attackers' motivations and more importantly, resources.

Answer 6

The risk is by far much worse in the first diagram. Take a step back and read about military DMZ's they are basically places you put things you don't care about protecting. It's bad terminology to begin with and an outdated idea in IT. Now let's say you have a much larger environment with different security levels, you can't throw all the data in one zone (much less allow your malware infected LAN traffic pilfer thought it). You'll need multiple security zones (multiple DMZ's if you're attached to that term, I call them secure-segments). How would you add say 20 different security zones to each of the diagrams above ? Continue adding them in series according to their security level ? or add them in parallel as needed ? The reason most modern firewalls have multiple interfaces (some large ones have up to 100 interfaces) is because we add secure subnets in parallel. In a high security environment you might have separate security-zones for web servers vs. dns servers vs. mail servers, etc.. That way if your web servers gets owned the attacker has gained no additional ground toward compromising your mail server or anything else. Likewise, if your a service provider hosting a dozen collocated clients you can put each one behind a different interface so they can't attack each other (or spread worms) any differently from attacking via the Internet. Browse around at some of the large vendors websites (Cisco & Juniper) and look at the documentation around their larger firewalls and how many interfaces they support. You will still want internal firewalls and Web Application Firewalls (WAF's) like Imperva (or mod_security proxies) but even these internal areas will need to be segmented and compartmentalized. The old sandwich diagram (70's - 80's IT architecture) is a major FAIL security-wise and needs to go away.

Answer 7

Yes, in addition to the previous answer I might add an IPS for blocking attacks that the firewall would not catch since those attacks would be targeting the open ports.

Answer 8

Your boss is right.

The first representation has many problems or weaknesses.

1. HA (high availability) : you will need 4 FW ( 2 externals and 2 internals) = $$$
2. Management : 'considered safer as you can use two different makes of firewall' ... a lot of management overhead (update, rules, logging, licencing). If you cannot trust your FW and you need an another one from a different manufacturer, you have a problem !!!
3. IP : this design can be a nightmare with natting, routing, etc.
4. Risk : In this design, a compromised DMZ host is in a nice place for sniffing and man-in-the-middle-attack against users in the LAN zone.

In real life, the second design is safer and simpler than the first one.

1. HA (high availability) : you just need another FW.
2. Management : just one box to manage
3. IP : single point to manage the trafic for routing or nating
4. Risk : if a host in the DMZ is compromised, this threat is contained in the DMZ

Answer 9

It depends upon the type of network architecture your building.

The first example is ideal for situations like hosting a large web app, you build up the security with in your layers, so balancers tier, app tier, data tier, each firewalled off by different security measures, but work on there own trusted networks.

In the second example exactly how it is described, with a LAN hanging off it. Also, this option is ideal for situations where by you need to be able to shape traffic to ensure QoS.

So to answer your question both are valid and both have there own advantages, there is no one silver bullet.

Answer 10

Most Firewall engineers mostly have deployed the 2nd diagram model since a set of firewalls are less expensive, easier to configure & manage. You may utilize each port on firewall for physical connection to outside, inside and each DMZ or use multi context (much like VM) to virtually segregate environments. We use the 2nd model in our smaller Data-centers and use the 1st model with multi FW at our enterprise data-centers. Auditors love the 1st model for enterprise locations as one mis-configured rule on 2nd model can cause an attacker who has taken control of your DMZ server, perhaps gain control on inside of your network. This is much harder on 1st model, as an attacker must go thru two sets of firewalls to get to inside. A firewall admin may make a mistake perhaps for testing on one firewall but not on two (usually). We just deployed multi firewalls last week. With Firewalls on Internet end connecting to multi DMZ and Load Balancers... and inside firewalls, connecting to the same DMZ / Load Balancers. Also the 2nd / inside firewall has multi context on inside. Which provides firewalling between WAN, production and none production environments...where production servers can access anything, but WAN can access production servers on www and https (etc.) or allow RDP access to admins to get to production and DEV/QA servers on inside Firewall.

Answer 11

The answer to the question on which of the two designs are "right" can only be based on the requirements placed upon the solution being designed. As such, both models have benefits and disadvantages but it really comes down to TWO PRIMARY DIFFERING BUSINESS DRIVERS:

If the business is making requirements with statements like:

"We need an Internet / DMZ security design that is ...
*cost-effective, lowest cost, basic, simple design, simple to manage, cheap & dirty, adequate protection...*etc."

Then the 3-LEGGED FW (example #2) will be the model you should using as the basis for your design. And in a world where "SAVE $$$" "Reduce Costs" are often the #1 drivers, it is the primary factor why the 3-LEGGED FW Design is by far the most popular deploy - even for larger organizations.

If the business is making requirements with statements like:

"We need an Internet / DMZ security design that is ...
highly / extremely secured, provides the best internet protection regardless of cost, protection of our internal corporate systems are A MUST... etc."

Then the FW-Sandwich / 2-Teir FW / Layered DMZ (example #1) model is the one you should be using as a base for your design. The reason is extremely simple... Layered DMZ security adds additional unique barriers to entry for the Internet hacker. If he gets through the first FW, he lands at the next layer, and the next, and then the backend Internal FW before he has finally got to the crown-jewels of the corporate data. The 3-LEGGED FW model is 1 layer of protection whereby if poorly / misconfigured FW is compromised - he has direct access into the internal network. BAD !

My past designs are more complext than a front and back FW. In an extremely highly secured ISP/DMZ design, I architected FW, IPS, front VIP network, DMZ VIP Load Balancers, Private Farm networks, then the back-end Internal Facing FWs. Each of these layers adds a unique additional barrier to entry for the hacker to get through. We also set strong design rules that state "one layer in the design must only talk to the next layer and not bypass that layer as a shortcut"

This design is surely more costly, but for large scale enterprises whereby banking, financial, large databases of client information, etc MUST BE PROTECTED, it would be foolish to use a 3-Legged FW that makes it the single barrier between the hackers and these crown jewels.

Answer 12

First option is wrong because you will turn the firewall into a router, and firewalls should not be routers. Second option is good, but you can add that second firewall to the internet, but keep the DMZ on the internal Firewall.

DC