topic Re: Securing Traffic through PIX in Network Security

Securing Traffic through PIX

fmatrine — Fri, 21 Feb 2020 08:20:34 GMT

Hi All,

We want to give network access to our business partner (Banks)

Also we want to secure our infrastructure from banks activities.

How can i acheive ...

Pls suggest...

Attaching the proposed topology diagram.

Re: Securing Traffic through PIX

fmatrine — Thu, 18 Aug 2005 11:10:21 GMT

attached topology

Re: Securing Traffic through PIX

jmia — Thu, 18 Aug 2005 11:10:43 GMT

Site-to-Site comes to mind! and tie down the vpn traffic using ACLs.

Jay

Re: Securing Traffic through PIX

jmia — Thu, 18 Aug 2005 11:34:20 GMT

Your topology looks ok but what I would suggest is for you to read the Cisco SAFE Security Blueprint, it can be found on the right hand side of this page under 'Related Links' or below:

http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_package.html

Hope this helps a little.

Jay

Re: Securing Traffic through PIX

fmatrine — Thu, 18 Aug 2005 12:27:27 GMT

Hi Jay,

Thanx for the reply.

We are not looking at VPN solution.

As the business partner will come over private leased line and not thru internet.

Our requirement is to allow business partners (Many Banks) to access few of our servers in DMZ and Inside network in a secured manner.

Banks network will come over wan and in our premises we will get a ethernet from all the banks.

what we are planning is to terminate all the ethernet coming from different banks on a L3 switch in different vlan interface.

Purpose of creating vlans on the L3 is to control the traffic (Inter-vlan) coming from different banks and filtering the traffic at the L3 only.

secondly we will have the L3 connected to PIX interface facing the Bank-Zone as shown in the proposed topology attached.

We will create a static NAT between Bank-Zone interface subnet and various servers in DMZ and Internal network.

Subsequently we will allow the services for specific IP's only.

This way we will hide our inside+dmz private ip to be seen by bank network, as the bank clients will connect to the natted ip for accessing servers in DMZ and inside lan.

Kindly suggest if this is OK from security perspective or do we need to add any component.

Re: Securing Traffic through PIX

rsmith — Fri, 19 Aug 2005 19:48:11 GMT

It looks like you are setting this up very well, maybe tighten it up to only allow to specific TCP services on the servers? And I would LOG, LOG, LOG, all activity to/from these extranet partners.

Good points I see:

1: VLAN separation of banks from each other!

(access-lists, no traffic between bank vlans)

2: NAT of your internal servers to extranet

3: Access only to specific servers (nat address) from banks

(lock down to ports/services?)

I would think about adding an IDS/IPS component, to be sure that nobody attempts to circumvent your security arrangements.