How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen have centered on locally defined firewall rules or had dozens of group policies.
I have been thinking it would make sense to extrapolate my rules endpoints into three broad categories, much as the Open PCI Scoping Toolkit does and creating only four general rules.
The groups would be :
L1: PCI servers and workstations L2: Support servers and IS workstations L3: General users and tertiary servers
The four rules sets would be:
L1->L1 L1|L2|L3->L2 L2->L1 L2->L3
I'm thinking that from here I should be able to simply list all services that might be installed and running on a given level to grant access as outlined above.
L1: SQL, IIS, SMB L2: SQL, IIS, APP1, APP2, etc
Is there any security problem with defining only four rule sets as outlined using these three levels?