Re: switches in a fw environment

[Bennett Todd <bet () mordor net>]

1998-06-30-18:20:43 Gerhard Mezger:
> How do you feel about the usage of switches interconnecting different
> security domains?

So-so. Depends on other matters. If the different security domains aren't
believed or expected to have active attackers actually residing on them, this
might not be _so_ ghastly.

For sure, the nicest setup is to have a separate interface off the firewall
for every distinct security domain in the DMZ, as well as the external
screening router and the internal screening router. But if you don't have an
infinite budget, other architectures start to look attractive. The next
cheapest, for good fast performance to DMZ hosts, is to have multiple
interfaces off the external screening router for the DMZ hosts, and to use
very very restrictive rules on that router. Using a stateful filter like a
Cisco PIX as that external router can give this even more muscle, though if
you take care to restrict what protocols are permitted to DMZ hosts (e.g. no
ftp) and you use a good hard OS (e.g. OpenBSD configured really tight) then
the stateful filtering won't buy you much additional security.

But if you can't afford a multi-interface screening router, and you have
multiple DMZ clients in different security domains, then you could get pretty
good security by using a hub (or a switch for performance) off a DMZ interface
off the firewall bastion host. E.g.

    internet ----- firewall --- internal net
                      |
                      +-(DMZhub)--- ...
                         |   |    ...
                         |   +-- dmz server 2
                         +-------dmz server 1

As always, the bastion host firewall has to be secure. Furthermore, with this
setup, the protections _between_ hosts within the DMZ are weaker; so those
hosts will even more urgently have to be well-secured basstions in their own
right. But if you put each of the DMZ hosts onto a different net (e.g. using
the the RFC 1918 class Cs 192.168.{0-255}/24) then the firewall will still get
to route all traffic between them unless they got root-level compromised, so
it could still help to reinforce guarantees expected by the application level.
This is still weaker than having a separate interface off the bastion for each
host in the DMZ, and still slower than having a separate interface off the
screening router for each one.

But you do _not_ want to expose a hub or switch that has hosts which need
protecting directly to the internet.

Your proposed architecture:

    internet ----- DMZhub --- internal net
                      |
                      +- firewall bastion
                      |
                      +- DMZ web server 1
                      |
                      ...

is substantially weaker. It could be liveable in some circumstances if the
external screening router (labeled "internet" in the above pictures) were
configured to refuse to route any traffic from the internet to any machine
except the firewall bastion. But at that point you've got the same performance
as the much more secure designs, with somewhat poorer security, just to save
the cost of a single bastion host network interface. Sounds like a bad deal to
me.

As for the security of switches, they aren't security devices by design, and
so as is to be expected they aren't effective security devices. Hang a sniffer
off one and watch what you see; you'll see packets that you wouldn't expect.
Then pound it with a spray of packets deliberately designed to flush its MAC
tables and you'll see a lot more. Routers are designed to route, and so tend
to do the most basic network partitioning pretty robustly, and Cisco's packet
filtering implementation seems to be pretty solid. Set yourself up a bastion
host running the latest OpenBSD with IP-Filter and you've got something that's
seriously hard to weasle past.

-Bennett