|
justmee -> RE: New DMZ Infastructure (25.Jun.2008 11:41:05 AM)
|
Hi,
Ahh, the Cisco - ISA back to back with VPN connections stuff...
There was some kung-fu fighting here:
http://forums.isaserver.org/m_2002067633/mpage_1/key_/tm.htm#2002067988
Jason seems to have the black belt[;)]...
It looks that what you want is to terminate the site-to-site VPN connections on ASA(people seem to agree that this is a good idea).
In this case you will have a route relationship on ISA between the Internal and External Networks.
If you follow this approach personal I would *not* place any device in the DMZ between ISA and Cisco FW. At a first glance I would put that "FE email server" on an ISA DMZ. If you have a two cent anonymous web server you can put it on a Cisco FW DMZ.
It would be better to terminate VPN remote access connections on ISA.
So you offload VPN site-to-site traffic from ISA(in theory better performance, for example you have the Cisco FW dealing with decrypting/encrypting site-to-site VPN traffic, fast junk incoming traffic cleaner, DoS limiting, IPS maybe; ISA deals with remote access VPN traffic, web proxy, if you use the FWC you can control other traffic than web traffic based on users credentials thus better control over outbound access, offers better protection for your Exchange servers-OWA SSL bridging with pre-authentication...), and maybe eliminate some worries/problems associated with IPsec tunnel mode connections and ISA.
The DMZ between firewalls is used to retain some attacks. However in order that this to happen, you need to know exactly what traffic you pass through your firewalls and have *only* the required firewall policies allowing just needed traffic on both firewalls. You need to understand the routing/traffic path too. And also to understand the goods and bads of your firewalls, their strong and weak points.
For example if the Cisco FW would be alone, a vulnerability of it may permit traffic to escape through it. But with the back to back design, ISA may stop the exploit blocking the malicious traffic. Or if a vulnerability of ISA permits some traffic to escape through it, the Cisco FW may block that traffic.
Or maybe if some malicious traffic may pass through the inspection of one of the firewalls, the other firewall may stop this traffic.
The front end FW will apply its own DoS limiting policies, so ISA will have to handle fewer connections in case of a DoS attack(assuming that the front edn FW "will still stand", and not become DoS-ed itself).
Everybody has its own ideas about "DMZs". Personal I like and take into serious security zones. I've cascaded once 10 firewalls. That was fun.
As you can see with the back to back approach you have some flexibility and better security, you can distribute a little bit your requirements(ISA handles better some of them, the Cisco FW others). Due to the distribution you may get better performance, and performance is related to security.
Personal I'm not a fan of the parallel approach with ISA and Cisco FW. IMHO, the back to back design offers better security because each firewall functions as a trully gateway for traffic, traffic must pass through it to go in or out. It's like having two back to back doors to your house, and you need to unlock both of them in order to enter your house or to get out of it. But maybe you will find that the parallel design will have certain advantages for you. Your call...
Regards!
|
|
|
|