11
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
No.
I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses.
NAT only add complexity without increasing security, if the network and the ...
- 19k
10
votes
Difference between firewall and ACL
ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
- 65.2k
4
votes
High availability vs network mac/arp config
Probably, there is no such feature on a switch that would cause a delay, not on commonly used products.
You might want to first understand how the HA mechanism of your FW product actually works (VRRP, ...
- 8,122
4
votes
Difference between firewall and ACL
Stateful inspection is the easy answer to what is the difference between a firewall and access control list.
Access lists (ACLs) define interesting traffic. An ACL specifies network addresses and ...
- 4,349
4
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
Flip it around - when you deploy IPv6 on this network there will be no NAT, so why add complexity now that won't be available later.
Worse, if you dual-stack the network then v4 would have NAT and v6 ...
- 695
4
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
NAT was never designed to be "security". It was a mechanism to increase the IPv4 address pool. (many behind one) In that era, no one was very concerned about security.
The security NAT ...
- 30.8k
4
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
Just to add to JFL's answer: while not increasing security, NAT does add complexity to the setup, as you've pointed out. Complexity is your foe when trying to secure things.
In a nutshell: if you can ...
- 78.2k
3
votes
Accepted
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
- 1,160
3
votes
ARP cache in firewalls and difference from an end point device
You have some misconceptions.
No fancy tools/techniques to prevent two hosts to have the same IP
address with different MAC addresses.
That is an OS requirement for your hosts, nothing special or ...
- 97.2k
2
votes
Difference between firewall and ACL
These are different levels of abstraction.
A firewall is a device or software component whose purpose is to protect a network or computer from unwanted traffic. There are many different types of ...
- 436
2
votes
Is it best practice to restrict access from non-DMZ hosts to DMZ hosts?
Security zones are usually categorized by their security level (=their need for protection).
The basic rule about inter-zone communication is that you often permit higher-security hosts access to ...
- 78.2k
2
votes
Accepted
Routing VLANs to Firewall Ports
Your current topology is exactly as it should be. You don’t need layer 3 switch functions. You don’t add complexity just because it’s a waste of it’s power.
- 65.2k
2
votes
Accepted
Valid uses for IPv4 Options [Community-Wiki]
IPv4 Options-handling recommendations from RFC 7126: Best Current Practice: Filtering of IP-Optioned Packets:
IPv4 Option Name
Type
Usage notes / Comments
Firewall Recommendations
No-Operation
1
...
1
vote
connect two private network using pfsense
Not clear on PFSense, whether it is allowed/on topic here or not, they do sell paid support so I think it's ok. The short answer to how to achieve what you want is a Lan to LAN (also called Site to ...
- 1,160
1
vote
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
Zero Trust (ZT) is a security concept that assumes all users and devices are untrusted until proven otherwise.
Your question is about Zero Trust Network Access (ZTNA) which is an implementation of the ...
- 404
1
vote
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
Conceptually speaking, TLS and VPN are very similar. Vendors can, and often do, recast their VPN products as Zero Trust in order to capitalize on the marketing value.
- 65.2k
1
vote
Cisco NGFW FTD NAT/PAT pool exhaustion monitoring
I'm not sure if this info applies to the Firepower OS (I think your model runs FXOS) but it might help:
https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&...
- 1,160
1
vote
Is this possible? Adding a local device of my home network in client network without firewall configuration at client side (VPN?)
Can I plugin a (embedded?) device with some software running on it
(VPN client/ server) to which I connect my laptop?
What you propose is installing a backdoor in a network you do not control. This ...
- 19k
1
vote
Accepted
Cisco ASA not accepting external traffic without NAT configuration
After doing some tests with GNS3 and talking with the owner of the upstream router I have clarified all the problems.
My first problem, not being able to capture traffic, was because I was filtering ...
- 121
1
vote
Accepted
VLAN and firewall interconnection
You haven't specified which kind of firewall you're using, so we can only provide general advice.
You can either use a separate connection for each VLAN between the central switch and the firewall - ...
- 78.2k
1
vote
Is it best practice to restrict access from non-DMZ hosts to DMZ hosts?
There is no one answer to your question. Whether it's "OK" depends on your risk tolerance, your relative vulnerability, and the sensitivity of your assets. Only you can answer that question....
- 65.2k
1
vote
What is the difference between having a firewall inside vs outside the network?
Deployment of firewalls is purely depends upon network design and according to business requirements . But basically firewalls deployed on perimeter level where firewall is exposed to internet traffic ...
- 817
1
vote
What is the difference between having a firewall inside vs outside the network?
No matter where you place the firewall it's purpose is to filter traffic based on various parameters.
However, the idea of a protected inside network, while still widely implemented, is a legacy ...
- 4,349
1
vote
Accepted
What is the difference between having a firewall inside vs outside the network?
In any case, both firewall and router are parts of your network, so the difference you're asking about is the firewall in front of the WAN router or the firewall behind the WAN router.
The common ...
- 78.2k
1
vote
Accepted
Inherent flaw in stateless firewalls?
Routing is stateless by design - each packet is routed on its own behalf, without knowledge of previous traffic. (An exception may be seen in NAT routing which is stateful (mostly), relying on a ...
- 78.2k
1
vote
EdgeRouter X select one out of two WANs according to target IP range
I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions.
You are doing this way too complicated. Routing by destination address/subnet simply ...
- 78.2k
1
vote
Accepted
Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)
As we where not able to solve the issue, we decided to do a "big bang". We connected all devices from the old network one by one to the new network as we could not get it done to run both (...
- 219
1
vote
2FA Setup for FortiGate SSL VPN
You have the following options:
E-Mail Token: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Based-two-factor-Authentication/ta-p/193019
SMS Token: https://community.fortinet.com/t5/...
- 164
Only top scored, non community-wiki answers of a minimum length are eligible