Firewalls at UNM 11/8/2018 Chad VanPelt Sean Taylor

Migrating from Cisco FWSM to Palo Alto NGFW What are we changing? 11/8/2018 Migrating from Cisco FWSM to Palo Alto NGFW Why are we changing? Standard Firewall that can block source port and IP / destination port and IP NGFW is a standard firewall that also includes Next Generation features such as:

NGFW Application based controls User id Stream based inspection (SP3) IPS Malware protection Superior visibility

Impact:

2 5060’s for perimeter and distribution Hardware 2 5060’s for perimeter and distribution 4194302 10G FW throughput 2 5050’s for Datacenter 2097150 5G FW throughput 2 3020’s for Gallup 250000 2G FW throughput

Deployment Phases Perimeter Datacenter Datacenter NSX Pilot Perimeter Distribution NATTING, IPS, Zone Protection Branch Campus

Perimeter Palo Alto 5060’s were the first firewall that was at the UNM Perimeter Others had tried but failed Vwire Deployment Transparent mode Bind two network ports together No routing or switching performed Very simple configuration, Does not require any changes to surrounding or adjacent network devices

Datacenter Layer 3 Deployment Routed mode High availability Active Passive Security incident was the catalyst of replacing legacy firewalls The firewall handles routing responsibilities “On a Stick” Routes in and out of datacenter and in between datacenter Zones

Datacenter NSX Not really a Phase but an interesting test. VMWare NSX integration with Palo Alto Purpose Send interesting traffic from Virtual environment to Palo Alto for inspection and posturing Dynamic address groups and Automation Add an ip address to groups on NSX and they will be automatically added to inspection on palo alto

Security Policy above the Forwarding Plane NSX Distributed Firewall Web DB App App Web DB NetX API re-directs data flows to PA. Virtual Switch Forwarding Plane Hypervisor NSX Distributed Firewall

Distribution Palo Alto 5060’s at perimeter are also functioning as Distribution firewalls Layer 3 deployment Using same model as the datacenter. All zones get routed at Palo Altos Currently migrating legacy firewall customers We have a general zone for all customers that do not have a configured firewall zone During this phase we added High Availability to our perimeter boxes. They are now in Active passive.

NATing Currently using bidirectional and source Nat through Palo Alto Customer that needs only outbound communication Bi Directional Nat Customer that need to access resources off campus and on campus

Zone Protection Flood, Reconnaissance, and Packet based attack protection Flood Protection SYN, ICMP, UDP, and PPS (Alert, Activate, Maximum) Reconnaissance Protection Host Sweep, TCP Port Scan, UDP Port Scan (Allow, Alert, Block,) Interval / Threshold 10 sec per 100 events Packet based attack protection Spoofed IP address Fragmented Traffic

Intrusion Prevention Technology that examines network traffic flows to detect and prevent vulnerability exploits. Secondary inline at Perimeter Tipping point IPS does heavy lifting at perimeter Defense in depth Ability to active IPS policies on a zone based Single Pass Architecture Dedicated processing Stateful pattern matching

Intrusion Prevention Technology that examines network traffic flows to detect and prevent vulnerability exploits. Secondary inline at Perimeter Tipping point IPS does heavy lifting at perimeter Defense in depth Ability to active IPS policies on a zone based Single Pass Architecture Dedicated processing Stateful pattern matching

What does this mean for your department?

All departments will be receiving a basic level of firewall service under new architecture. Enhanced, customized firewall services are available for a small monthly fee.

University specific risks The nature of University traffic requires a very liberal default security posture compared to secured corporate networks, etc… Majority of University is still on public IP addresses Research Universities are often a target of intellectual property theft attempts. Attacks that we see often range in the millions to tens of millions of hits per second.

LoboZone: Minimal set of policies and inspections to block the worst of the worst. Polices determined by IT Security and Data Network Group. No customization allowed. Not protected from any other departments in LoboZone.

Department Specific Zones: Dedicated security zone with rules and inspections set by local department IT administrators in consultation with UNM IT Security. Cost is: $75/month

Department Specific Zones : Dedicated security zone with rules and inspections set by local department IT administrators in consultation with UNM IT Security. Cost is: $75/month

Department Specific Zones : Possible options: Block all inbound traffic except for specific traffic to specific servers Block access to certain categories of URL’s from your department computers Block specific attacks that you have had directed at your department such as SSH Brute Force, etc…

Other possibilities: Dedicated firewall contexts for areas that manage large number of departments Possibility of dedicated physical firewalls for high- security environments that require physical separation Costs and design would be negotiated on a case by case basis.

Questions?