Firewall design for big enterprise business

Question

I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks.

For example should the network atleast have the following firewall zones?

• Client network
• DMZ
• Customer facing network (internett)

Is it considered best practice to keep and maintain firewalls inside the zones (on each individual server) aswell as on the zones itself?

I would appriciate any tips regarding best practice designs of firewalls.

Answer 1

'Best' is probably not the right word here, as the specifics vary with needs, however 'standard' industry practice for enterprise level financial services organisations (a good benchmark) includes:

Client network, with segregated access-controlled subnets for specific key assets (usually customer databases, HR data, financial data)

• FIREWALL

Multiple DMZ's - usually split either by function or risk profile (eg a DMZ for transactional services, one for remote access for staff, and another for 3rd party connections)

• FIREWALL

Internet, remote clients etc

Firewalls should be from different vendors eg Juniper, Cisco, Checkpoint etc. to increase the time an attacker would take to get past them both (would require two exploits)

Answer 2

should the network at least have the following firewall zones?

Not necessarily.

It's a fairly common model though.

I'd recommend (in addition to all the usual security measures)

• implementing the OS firewall on all machines as well as using dedicated firewall devices where appropriate
• implementing proper egress filtering on the OS as well as on the network devices

Also, getting your routing set up correctly is an essential part of network security.