CCSP SelfStudy CCSP CSI: Exam Certification Guide, Second Edition [Electronic resources] نسخه متنی

Corporate Internet Module in Small Networks

The Corporate Internet module provides internal users connectivity to Internet services and provides Internet users access to information on the corporate public servers. This module also provides remote access for remote locations and telecommuters through the use of VPN connectivity.

Several key devices make up the Corporate Internet module. These devices are described in Table 13-2.

As shown in Figure 13-2, either a Cisco IOS Firewall router or a PIX Firewall is used within the Corporate Internet module. The particular choice of hardware platform depends on the specific network requirements and any associated design criteria. Design considerations are discussed in subsequent sections of this chapter.

Mitigating Threats in the Corporate Internet Module

The most likely point of attack within the Corporate Internet module is on the public services segment. Positioned on this segment are the publicly addressed servers. Table 13-3 shows the anticipated threats and mitigation actions expected on this segment.

^[*] CAR = committed access rate

Figure 13-3 displays the threat-mitigation roles of each of the devices found within the Corporate Internet module.

Design Guidelines for the Corporate Internet Module

The small network model represents a scaled-down security-centric network design with all the security and VPN functionality that is found within a single device. As described earlier and shown in Figure 13-2, two options are available within this design model:

• Cisco IOS router

• Firewall

The first option uses a Cisco IOS router with firewall and VPN functionality. This option provides the greatest flexibility within the small network design because the router is capable of supporting not only the firewall and VPN functionality but also the advanced features now offered to Cisco IOS routers, such as QoS and multiprotocol support.

The second option available in the small network design is to use a dedicated firewall, but because most firewalls are Ethernet-only devices, deployment issues might arise if a WAN termination is required for the ISP circuit. If WAN connectivity is required, a router must be used in the design. However, using a dedicated firewall does have the advantage of easier configuration of security services, and a dedicated firewall can provide improved performance when performing firewall functions.

Whichever option is finally chosen, stateful firewall inspection is used to examine traffic in all directions, to ensure that only legitimate traffic crosses the firewall.

Filtering and Access Control

Even before any traffic reaches the firewall, it is ideal to implement some form of security filtering on the perimeter traffic flow. Table 13-4 shows the filter parameters that can be applied to perimeter traffic flow.

The stateful firewall also provides connection-state enforcement and detailed filtering for sessions initiated through the firewall. Additionally, the advance features within the software protect against TCP synchronization (TCP SYN) attacks on the publicly facing servers by controlling the limits on half-open sessions that are transiting the firewall.

With reference to the public services segment, the filtering of traffic should control not only the flow of traffic destined to specific addresses and ports on the public services segment but also the flow of traffic from the segment. This additional level of filtering prevents an attacker who may have compromised one of the public servers from using that server as a platform to launch further attacks on the network.

For example, if an intruder has managed to circumvent the firewall and host-based IPS security features on a public-facing DNS server, that server should be permitted only to reply to requests, not to originate requests. This prevents an intruder from using this compromised platform to launch additional attacks.

Finally, the use of private VLANs on the demilitarized zone (DMZ) switch prevents a compromised server from being used to attack other servers on the same segment. The implementation of private VLANs is especially important because this type of vulnerability is not detectable by the firewall.

Intrusion Detection

Every server on the public services segment should be configured with host-based IPS software, which allows for the monitoring of rogue activity at the operating system level. host-based IPS can also be configured to monitor certain common server applications. Additionally, all public service applications, such as the web, mail, and DNS services, should be hardened as much as possible so that unnecessary responses cannot be used to assist an intruder in network reconnaissance.

The advanced software features found in Cisco PIX Firewalls and Cisco IOS Firewall routers provide some limited NIDS functionality. They can normally drop many types of attacks without the use of an IDS management station, but obviously dropped events are not reported. However, because these devices are not specifically designed for intrusion detection, it is possible that a degradation in performance of the device might occur. If performance degradation does occur, the drop in performance is normally acceptable when compared to the benefits gained from an increase in attack visibility.

VPN Connectivity

The firewall or Cisco IOS Firewall router provides VPN connectivity for the small network design. Authentication of remote sites and remote users can be accomplished by using preshared keys or the use of an access control server located in the Campus module.

Design Alternatives for the Corporate Internet Module

Usual deviations from these design guidelines normally include the breaking out of the functional components in the network from a single device to individual, specific devices or an increase in network capacity. When these functions are broken out, the design begins to take on the look of the medium-sized network design, which is discussed in Chapter 16, "Implementing Medium-Sized SAFE Networks." Before you decide that you have to adopt the complete design for a medium-sized network, however, it may be worth considering the placement of a Cisco VPN 3000 Series Concentrator or router on the DMZ to offload processing of VPN traffic. The addition of this device also increases the manageability of VPN connectivity.