3

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and web access needs. They also have their own web server which hosts a simple informational website.

The current architecture, set up five years ago by a local technician, is pretty simple:

Current Small Real-Estate Agency Network Architecture, basic diagram

Having no previous experience with deploying IPS/IDS or firewalls, I wanted to ask this forum to comment on the following ideas.

  1. Between the WAN link and the current router: I can get a used, working Cisco ASA 5510 for almost nothing. It's an old model but - probably - could do the trick here. Otherwise, I was thinking of a dedicated pfSense Linux machine with three NICs. Two will route the traffic, and a third can be used as a network tap when needed.
  2. Port mirror on the switch and use Snort or Suricata as an IDS, with alerts going to an outside consultant (me or anyone else).
  3. The Windows machines are connected using a 2008 R2 running Active Directory. In its current form, AD is only used to control user access to the desktops, shared folders, and printers. I was going to implement basic security-related group policies to further restrict access on a as-needed basis.

EDIT: There shouldn't be any intra-VLAN traffic. Currently, no ports are set to negotiate trunks and they don't use the native VLANs.

Any comments or suggestions are appreciated. Thank you.

Improve this question

1 Answer 1

Reset to default
2

1) Does the current Cisco router have any firewall abilities? If not, the ASA sounds like a good idea to me. If its a small office, you could probably just go with a 5505 and be fine.

2) I would get a box and put Security Onion on it. Set up a SPAN port on the current Cisco router to mirror traffic to the SO machine. Assuming the Cisco router is doing all the inter-VLAN routing, you can get a pretty good view on things. You won't have much of a vantage point on intra-VLAN traffic but that may not matter to you.

3) Seems standard basic security on an AD domain to me.

Improve this answer
1
  • I didn't think about Security Onion but it might work in a port mirroring on the Cisco router. I've edited my question to clarify that there isn't (and shouldn't be) intra-VLAN traffic.
    – David_Springfield
    Mar 4, 2014 at 12:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .