I am studying for my CompTIA Security+ qualification and have come across the following question.

Question :

You are implementing a testing environment for a development team. They use several virtual servers to test their applications. One of these applications requires that the servers communicate with each other. However, to keep this network safe and private, you do not want it to be routable to the firewall. What is the best method to accomplish this?

My thoughts:

My issue is with the penultimate sentence of the question.
Namely, what would be one's reason for not wanting this network to be routable to the firewall?

  • 2
    ...to keep the network safe and private. In other words, to prevent outside access. – ztk Jul 7 '15 at 14:28
  • Ah. So, if the network were routable to the firewall, would it be possible for a malicious outsider to access the firewall and disable it? – Caleb Owusu-Yianoma Jul 7 '15 at 14:30
  • 2
    That's one possibility, a more likely scenario is that poor network security practices will allow malicious users to access the network. – ztk Jul 7 '15 at 15:04

The only real reason to prevent a network from being routable through a firewall is to make sure it's isolated both from external and internal unauthorized access. It's impossible for someone to hack into a system if there is no physical path for electrons to travel from their position to the target system's position. By unplugging any cables linking the target system(s) to the rest of the world this ensures there is no physical path.

This does however drastically reduce the network's functionality and ease of use since you'd need to be in a specific physical location to interact with any of the target machines. The more secure something is the harder it is to use and the less functionality it has.

If the testing environment doesn't need internet access then the best/easiest thing to do would be to just not connect it to the firewall at all. Just create a testing subnet, put all the servers in it and plug them all into a switch. All the servers will be able to talk to each other and since there is no physical connection to the firewall it's impossible for anyone that doesn't have physical access to the switch or servers to access them.

If the testing environment does need internet access then I would still create a network zone for them (same as above) but in the firewall I would ensure there is a deny rule for any traffic destined for the testing environment. Since any firewall I've seen manufactured in the past 5 years has statefull inspection turned on by default and most of them don't even have an option to disable it, this will allow the servers to reach out to the internet and traffic coming back on that same port will be allowed.

Depending on what exactly they mean by "safe and private" the second scenario is the most likely to be implemented in real practice since almost everything needs to reach the internet for remote management and patches. The first scenario though is the "safest and private-est".

  • 3
    The question is about "why not", not "how not". – Mark Jul 8 '15 at 2:47
  • @Mark Thanks for pointing that out. I was too focused on the question portion and not the added question in the "My thoughts" section which was the real question. – JekwA Jul 8 '15 at 16:43

Requirements vary per organization (EX. Lockheed Martin probably wouldn't want their code for fighter jets accessed from outside the development environment ).

While the CompTIA context is extremely broad, remember firewalls don't just prevent access between outside forces and your internal network. The are also used internally in larger organizations to control access in a layer security approach such as having DMZ's or segregating a PCI environment from from the rest of the internal network.

Back to my earlier example (no I don't know work for LM), it would be completely conceivable to have a FW in place as a security layer to protect internal outside connections from getting into a development network or to prevent development connections from reach outside the environment. The business case may be centered between preventing unauthorized employees from accessing information rather than an outside actor.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.