5

Based on network design model proposed by Cisco, the firewall is for traffic to/from internet and there is no dedicated firewall for traffic to/from intranet. Is firewall on distribution switch is great enough e.g. Cisco catalyst 3560 switch?

Based on figure below. Assume that the in-switch firewall of 3560 is not enough. Let's say there is no VLAN and there are 2 departments, finance and marketing, separated by their access switch on the same distribution switch. Both departments contain sensitive information both in user computers and servers. However, users from both department have to communicate with each other.

enter image description here

Allowing users to communicate with each other in different department has opened attacking opportunity. For example, users in finance department can send malicious program to users in marketing department and vice versa if they communicate with each other by using chat program, for example Skype.

Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?

Update 1: Added picture and details.

Improve this question
4
  • Do you mean 3560 or 3650? They have no firewall capabilities except for ACLs. ACL's won't do Deep Packet Inspection so it depends on what your demands for security are.
    – Daniel Dib
    Apr 13, 2014 at 9:39
  • @RonVince One of the big issues you would face with setting up these types of restrictions between VLANs is that there are no real inside/outside firewall interfaces.
    – Ryan Foley
    Apr 13, 2014 at 9:46
  • Is this a real problem or school work?
    – Mike Pennington
    Apr 13, 2014 at 11:19
  • I made up the problem/situation myself to understand how intranet is supposed to be designed with dedicated firewall using the network design model proposed by Cisco as the base design.
    – Ron Vince
    Apr 13, 2014 at 11:26

1 Answer 1

Reset to default
4

Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?

Replace the c3560 with a firewall and IPS module; I operate a topology similar to this at work.

If you're merely concerned about 3rd party chat programs like Skype; the best option is blocking all skype traffic going to the internet altogether. That way, nobody will even be able to connect to the skype service and find other parties. It isn't worth firewalling departments if skype is the only problem.

No matter what you also need endpoint security solutions which scan for viruses and account for authorized/unauthorized applications. Consider the reality that files are shared with usb sticks as well.

Improve this answer
2
  • I want to allow the communication between both parties. In my workplace, we use Skype to communicate with each other in the same and different department/subnet. By the way, are there any performance penalties by using firewall/IPS instead of L3 switch?
    – Ron Vince
    Apr 13, 2014 at 11:43
  • 4
    There are no performance penalties as long as you buy a big enough firewall. Skype is the wrong way to operate a private Corporate chat. Use microsoft lync or jabber if you need internal messaging. There is no security in your IM solution unless you control the chat server and can log all activity at a central location; skype facilities neither for corporate users. Consider what could happen if someone started leaking internal corporate documents outside the company with skype. Lync and internal jabber services give you a way to limit this behavior.
    – Mike Pennington
    Apr 13, 2014 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.