7

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged into one physical interface on the firewall. The DMZ zone is defined on the firewall itself and is trunked to a layer 2 switch from a separate physical interface on the firewall.

Is this a fairly secure way to separate our trusted zones from our DMZ or does this pose a lot of problems?

Also does having the DMZ vlan defined on the firewall and trunked to a layer 2 switch pose a risk or should I look into getting another layer 3 switch for the DMZ as well?

I have considered trying to get funding for a second firewall to place between our primary firewall and our trusted zones but I don’t know if that would be the best place to make a change to yield the best amount improvement if at all.

enter image description here

Improve this question
2
  • It may help to add a diagram if you have one..... (I think I have the right picture in my head, but i may be misunderstanding)
    – Ormis
    Commented Jul 1, 2011 at 18:02
  • I'm not the best in Visio but I hope this helps =)
    – YerPhate
    Commented Jul 1, 2011 at 19:22

2 Answers 2

Reset to default
2

From what I understand this is less of a security question and more of a network engineering question, though security engineering definitely has a place any network design.

First you're going to need to draw out what you are doing. Which you did in the time that I was writing this, haha. I've also attached the Visio that I threw together when I first read your question.

enter image description here

Next I have to ask about something. You said that the DMZ is "trunked to a layer 2 switch." Does that mean that you actually are trunking VLANs to the layer 2 switch? If so you may want to drop your VLANs at the firewall interface. Especially if you're not trying to accomplish a sandwich DMZ configuration. That DMZ switch seems like it should be untagged.

I don't think there is any need for an additional switch for your DMZ, unless you have size and configuration concerns. If it's a small scale network, as I envision, you should be set with the small DMZ on-a-stick configuration.

Many small business all-in-one type appliances have a very similar setup. I have seen many Checkpoint edge appliances used in this same exact configuration.

Granted that the more security/separation you can provide the better when it comes to security, but this setup is perfect for a small business or home setup.

Also, I just came across this article which has an extremely brief explanation of this same configuration here.

Improve this answer
5
  • 2
    eeeewww, the globe in that image turned out terribly pixelated...
    – Ormis
    Commented Jul 1, 2011 at 19:47
  • Does that mean that you actually are trunking VLans to the layer 2 switch?
    – YerPhate
    Commented Jul 1, 2011 at 20:17
  • The reason that they are trunked is that I have 8 separate DMZ zones configured on the firewall so that I can more easily manage the ACLs and to logically seperate services such as public web servers app servers e-mail firewalls etc... I would have put each DMZ on a separate Interface but I did not have enough physical ports. The zones are really defined on the firewall as subinterfaces of a single port, but they have vlan tags on them so they can be properly assigned on the switch if that makes any sense.
    – YerPhate
    Commented Jul 1, 2011 at 20:25
  • Alright, if you've check the configuration and it's functioning as expected, seems fine to me. But it does seem a bit odd to have that many DMZ zones when you can use ACLs on a more granular level and maintain a single trust zone for the DMZ.
    – Ormis
    Commented Jul 1, 2011 at 20:45
  • I agree with you that so many DMZ zones are strange. I inherited this setup from a previous admin and some in house software is so engrained with static IPs its more of a headache to change than to continue on.
    – YerPhate
    Commented Jul 5, 2011 at 19:49
0

The setup seems fair to me, I don't see any flows that cannot be easily identified and filtered at the firewall.

When talking about the VLAN defined at the firewall and the secondary firewall, the real question is what attack scenario it is that you want to defend against. DMZ means you're considering compromised servers. In the given setup, the firewall will (potentially) protect against this. There may be reasons for a second firewall at/on the Layer3 switch depending on what flows should be allowed between the VLANs.

The trunking between FW and DMZ switch you do to increase network throughput, right? Because I don't see a security reason for having a VLAN on the DMZ-side of the FW.

Improve this answer
1
  • The trunking is done just to break the DMZ into different subnets for easier manageability of the access lists that allow access to the DMZ from the trusted zone. For instance I can easily limit access to the SPSS server to just our finance department’s trusted subnet.
    – YerPhate
    Commented Jul 5, 2011 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .