2

In my company we had firewall as edge device with the internet. Behind this central firewall we have management network. Now we had to put Cisco router in front of central firewall, as part of some services from ISP.

This router have all interfaces with public IP addresses and he is pretty visible on the Internet, therefore more vulnerable.

There is no remote management access to the router from the Internet. 

Is it safe to connect mgmt interface from that router to management network that reside behind the firewall?

If router is compromised over interfaces with public IP addresses, is there a possibility that rest of my management network could be compromised over management interface? Because I connected mgmt interface from that router to switch with management network, on which I have a lot of devices. And management switch is located behind the firewall.

I know that mgmt interface of the router is part of its own VRF, but is that enough?

Improve this question
4
  • 2
    Welcome to Security.Ex! Please, could you post a network diagram to illustrate what your network currently looks like? – J-- Jun 19 '18 at 22:47
  • This question really requires more clarification from yourself for us to provide a good answer, we're struggling to understand what you're trying to achieve and it would benefit us and yourself greatly if you could show us the network setup and what you're intending to do. – J-- Jun 22 '18 at 14:14
  • It may also help to have router model and software version. However, this doesn’t sound much different than what many service providers do for management access to their devices. Properly secured, this shouldn’t be an issue. – YLearn Jul 23 '18 at 0:20
  • AFAIK, routers only have 2 interfaces and are pretty much like f/w. One port would LAN and other would WAN. Or maybe you are taking about a L3 switch? – xandfury Apr 13 '20 at 7:16
0

If I understand this correctly, you have a MGMT interface on the public internet on a single device in front of your perimeter firewall. This is not unheard of, you can secure it. In your IOS just configure that port to be on your MGMT VLAN. Then add a access control lists to that interface so you cannot expose it if there is a misconfiguration later on.

Improve this answer
3
  • The way I understand it, this is not what he's asking. What he is asking is, is it safe for him to connect into the management network via a public IP address assigned to an interface on his router, the answer is; no. Why would he just not use a remote-access VPN on his firewall in this case? Then if he wanted to get onto the network he would just VPN in. Not to mention that if he is using access-rules to lockdown where he could come in from, what if he's working on site and he wants to get on his own management network? There would be no rule for that and it'd need to be configured. – J-- Jun 22 '18 at 14:05
  • 2
    If that is his intended design, just run away. No need for public access to your mgmt interfaces. VLANs are free, just set one up and run a cable. – Joe M Jun 22 '18 at 14:14
  • Yea that is my point entirely. It's hard to understand what he is trying to do without extra clarification, hence why I've asked for it but not received. However, I cannot see why on Earth he would want to connect via the routers public IP address into management, I fail to see why a remote-access VPN is not sufficient here. – J-- Jun 22 '18 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.