Introduction to Networking Firewalls Part Three

Using Cisco Security Appliance Configuration Utility We’re going to go over some of the steps we’d take when working with a Cisco Security Appliance The first thing we’d have to do is to change our username and password from the default username and password. This information is easily found online through the official company’s website or through third party websites like http://www.defaultpassword.com In this interface, to change things we would go to getting started, then select change default admin password and add users We’ll want to change the login information as well as the idle timeout. Why have an idle timeout? Note that changing the login information will log you out, so make sure you are certain of your new login info before you commit

User policies Where we add users, we can set login preferences, such as allowing or denying login from a WAN interface We can also set user policy by IP address to either block or allow certain IP addresses logging in Typically we would assign IP addresses as needed (for administrator’s work and home computers for example) and only allow those IP addresses to keep the configuration as secure as possible

Users and Groups So far we’ve been examining the configuration for the default administrator user, but we can create and modify policies for other users as well We can also create a group to modify multiple users at the same time. When we do we can also set LDAP attributes. This is an authentication protocol We can also set a domain in order to have a server provide the list of users and their access level

Web Servers and Hacking A firewall sitting on the boundary of our network will typically be configured to block all communication requests from the internet to our internal network However, what if we want to host a web server for our company to supply driver downloads, help support and an online store? We’ll need users on the internet to be able to establish a connection with us If we just open up our firewall, we’d leave ourselves fully open to losing our confidential data What are our options?

Option #1 - Put the Web Server Outside of the Firewall While this keeps our internal network secure, this would leave our web server too vulnerable Anybody could have access to our web server, and if they figured out the administrative username and password, they could change the contents of the website - for example, putting a virus download where the driver download should be

Option #2 - Put the Web Server Inside of the Firewall While this keeps our web server secure, this would leave our internal network too vulnerable For this to work, we’d need to reconfigure our firewall to allow outside access into our internal network. Fortunately, we can limit our outside port access to 80 and 443 (HTTP and HTTPS), but that still leaves us vulnerable to attack If someone were to use those ports to hack into our web server, they now have access to a host on our internal network, and can use that host to gain access to attack other hosts on the network

Option 3 - DMZ We can’t have our web server sit outside our firewall, and we can’t have our server inside our firewall. What we have to do is create multiple zones with different amounts of security The low security zone is typically called a demilitarized zone, or DMZ This way, we can put our web server on the low security zone, and allow ports 80 and 443 to be open, and put the rest of our internal network in the high security zone to protect it Anything that can be in the high security zone should be. The low security zone should only be used for hosts that ABSOLUTELY need to be accessible Also note that our web server is still vulnerable (though less vulnerable than with no firewall) We would still need to monitor it for attack

Multiple Firewall DMZ There are two main implementations for firewalls The first involves having multiple firewalls set up in a tiered system Recall that firewalls can be set to protect the whole network, a network segment, or even a single host This means that I can have a boundary firewall with the lowest level of security set up, and then an internal firewall which is more restrictive As a general rule, open communications can only be initiated from higher security to low. For example, low security can initiate a connection to the no security area (the internet), but not to the high security zone. The high security zone would be able to make a connection to either the low security area or the internet. The internet would not be able to access either, except for the exceptions we set up

Single Firewall DMZ Our other option is to use a firewall with multiple interfaces We can set up different rules configurations for each interface, to create a low security zone and a high security zone. We could even create multiple security zones if we have enough interfaces For example, if we were hosting an online game, we could have the game servers in one zone, the web servers for our website in another zone and our internal network on a third zone. The web servers would have ports 80 and 443 open, the game servers would have the ports for our game open, and our internal network would be safe

Multiple VS Single Firewall Using multiple firewalls will require more hardware and be harder to administer, but it will offer better protection to our internal network If an attack on the outer firewall is successful, the internal firewall will remain operational and continue to protect our network A single firewall solution makes it easier to create multiple zones, but we’re also creating a single failure point. If this firewall goes down, we either no longer have a network connection, or our entire network is now open and accessible

Routed Firewalls vs Transparent Firewalls There are two types of firewalls for these scenarios Routed firewalls function as firewalls and a layer three routers. This is actually very common, since many routers contain some level of firewall functionality Routed firewalls will count as a hop for routing purposes, and often contain multiple interfaces Transparent firewalls (sometimes called virtual firewalls) operate at layer two, and are not seen as a router hop. The internal and external interfaces will be on the same network segment. This allows us to easily connect this device to an existing segment, and is typically used as part of a multiple firewall system