1

I never keep a managed switch outside the firewall. However, I have a situation where I have to do that. I am connecting two Sonicwall NSA220 in HA configuration. So I have to use a small Ethernet switch in front of the firewall to connect the WAN cable to X1 port of both primary and slave firewall. I have ordered a pair of NETGEAR ProSAFE GS105Ev2 for that purpose.

Since the management IP of the managed switch has to be in the same subnet, I can only assign a WAN IP as the management IP of this switch. That means anybody can access this switch if I assign the IP, with password being the only defense.

What is the best way to deal with this? Not set the IP at all? I prefer to manage this switch, but not at the cost of security.

Improve this question
6

There are a few options with different security risks. You will have to decide which one(s) meets your needs.

  1. Use an out-of-band connection to the console port. This is probably the safest way, but may require additional hardware to make a serial connection.
  2. Create a separate VLAN on the switch and put the management port in that VLAN.Connect that VLAN internally or to a separate logical interface on the firewall.
  3. Use unique credentials for the switch, and make them more complex than normal.
  4. If the switch supports it, place ACLs on the management interface (this one doesn't).
  5. Set the default gateway of the management IP to the firewall. Most firewalls will not issue redirects by default.

I'm sure other readers can think of other techniques.

Improve this answer
2
  • Indeed. The correct answer is to by a better switch. The GS105 is web managed (at best -- layer-2 wacky protocol at worst.) – Ricky Nov 22 '15 at 1:41
  • I would do all of the above and I would add to use an encrypted protocol for management like ssh or https. – Todd Wilcox Nov 22 '15 at 22:06
1

If your firewall supports it, use secondary (private) addresses on the outside interface. NAT internal hosts to this subnet to talk to your poor choice of switch. This is logically creating a DMZ riding on the public network.

If you have the interfaces available, a physical DMZ for managing that switch would be the safest option. (consider the effects of typos, misconfigurations, stray cables, and hackers -- but that's a question for the security SE)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.