1

We have a bunch of company devices (servers, desktops, laptops, company-issue phones, etc). All of these devices are company devices, every employee uses them just for business. All devices should have the same filters applied.

Do I need two firewalls (one for LAN, one for WLAN Access point) like the image shows or is it enough, if I just use the firewall before the router? Do I really need the one I marked with red?

Network topology diagram showing a firewall between the intranet and the internet, and another one between the intranet and the internal wifi

Is that marked firewall just for setting more filters, or would there a bigger purpose for it?

|improve this question
  • 1
    The question is missing essential context: what do the different devices do, who manages these devices, what should they have access to. Firewalls are used to separate things. If for example on the right is the company managed network and on the left behind the red firewall the user managed BYOD (bring your own device) a separation using a firewall definitely would make sense. – Steffen Ullrich Nov 24 '18 at 19:23
  • I am sorry that I didn't specify. All of these devices are company devices, every employee uses them just for business. All devices should have the same filters applied. Please correct me if i'm wrong, but is that marked firewall just for setting more filters? or would there a bigger purpose for it? – Mister Anderson Nov 24 '18 at 19:49
  • 2
    In this case the difference might be that the devices on the right are static inside the company and always inside the company network only while the devices on the left are mobile and use different networks - which therefore increases the attack surface and thus protecting the devices on the right from the mobile devices make sense. But again - this is a picture taken out of some context and the full context necessary to interpret the picture is not provided. One could only guess what might have been meant based on some bread crumbs of additional information given inside the comment. – Steffen Ullrich Nov 24 '18 at 20:01
1

This answer borrows ideas from Steffen's comment. The answer is it depends, with a sprinkling of random internet people don't know enough about your organization to give a proper answer. But we can give you some points to think about.

As Steffen said: "Firewalls are used to separate things", usually to protect a higher-security group of users and / or devices from a lower-security group.

In a diagram like that, you have servers, desktops, laptops, and mobile devices. The usual assumption is that the servers and desktops are:

  1. where the sensitive data lives,
  2. running all the corporate-issue endpoint protection, anti-virus, and monitoring tools,
  3. only ever connected a clean packet-inspected network with other similarly trusted devices.

When you draw laptops and other mobiles on a diagram like this, the assumption is that these devices may or may not:

  1. be running proper endpoint protection, anti-virus, and monitoring tools (almost always the case for phones),
  2. get connected to random coffee-shop or hotel Wifi networks (or even employees' home networks) during which time they A) come in contact with infected machines and B) can browse to infected websites without the corporate packet inspection and monitoring tools there to protect you,
  3. get infected USB sticks plugged in,
  4. be easily monitorable / remotely wipable to prevent data being exfiltrated from the building,
  5. etc.

TL;DR: You need to have a think about what your organization's security and threat models are. If you decide that the phones and laptops really truly have exactly the same security needs and risk level as the servers and desktops, then you don't need a firewall there. However, in 99% of organizations, devices that are allowed to leave the building are considered to be at higher risk of infection, so it makes sense to have that firewall and only allow through the hosts and ports that the laptop users actually need to access.

The idea is to assume the laptops and phones are infected and reduce the amount of network probing that they can do on your internal network.

|improve this answer
  • Thank you very much for the detailed answer! Oh I see.. Now I completely understand the idea behind it.. Can you please tell me one last thing: Isn't it the same thing with desktops, the thing that I should only allow hosts and ports that needs access to? Or better asked: **If I wanted to have the same security for the all of the devices, but wanted to secure the desktops from laptops, do I need to change the security in the that marked firewall in any way? Or can i keep it the same as the first firewall (before router)? – Mister Anderson Nov 25 '18 at 13:42
  • I'm not sure I completely understand the question. You mean, should you place a similar firewall between the desktops and the servers? Probably a good idea. At my company we have a firewall there, but it's blocking less than the firewall in front of wifi / vpn connections because A) someone needs to maintain the servers, so we allow RDP access to servers but only from the wired network, and B) because of our fancy network monitoring tools, we consider desktops to be at lower risk of infection. You should sit down and think about your own risk assessment, and decide what's right for you. – Mike Ounsworth Nov 25 '18 at 14:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.