Would it be possible to use an IPS 4255 in this topology?

monkeyboy · ‎08-02-2005

(please see attached diagram - done in paint!) Basically I would like to use the ips 4255 to inlineIPS my internal network and also promiscous/IDS my DMZ.

The IPS 4255 has four interfaces - would this be a workable solution - also what are the potential security implications?

Many thanks

marcabal · ‎08-02-2005

No

In looking at your picture you would be trying to pair 3 interfaces (1 to left pix, 1 to right pix, and 1 to proxy/cache), and this won't work. To create an InLine pair you can only use 2 interfaces.

You would only be able to pair one Pix with the proxy/cache. Assuming you did that it will OK for most connections, but will have trouble with some others.

Connections coming in from the Lan through the proxy/cache through the InLine pair to the Pix then TO the DMZ 1 will again be copied to the sensor.

This second copy to the sensor could cause some confusion on the sensor. It works fine most of the time, but I have seen occasions where the sensor triggers a false positive and drops the packets.

hwon · ‎08-02-2005

That design would introduce single point of failure because of the inline IPS serving both PIX. You can still pass traffic when analysis engine dies by setting the bypass mode to auto, however, if the physical unit itself has problems you won't be able to pass traffic on neither PIX nodes. Installing separate IPS for each PIX device would be the fix.

Having said that, if I only had one IPS with four interfaces I would rather protect two of the DMZ with most services open to the Internet. Granted, having IPS on the inside segment is important, for one you will be able to enforce policies for outbound traffic, such as IM and P2P protocols. However, it would make sense to deploy inline IPS in the DMZ from mitigating attacks perspective, since most of the network based attacks from the Internet will be targeted at DMZ servers.

monkeyboy · ‎08-03-2005

Many thanks - unfortunately we're unable to have 2 IDS' - as per cost implications.

Out of the diagram - where would be the best place to terminate remote access VPN's - DMZ3?

Cheers

Mark

monkeyboy · ‎08-03-2005

...would this be a viable setup considering that the ips has to be able to monitor both the pixes?

hwon · ‎08-04-2005

I believe DMZ3 could be a place for the Remote Access VPN, as long as DMZ3 is dedicated solely for Remote Access.

With your IPS setup based on the new diagram should let you monitor traffic for both PIX units. But again, with no redundancy.

We had a case where we had to place one IPS inline for failover PIX pair. We were running active/standby PIX, so we placed IPS for active PIX only. Just wanted to throw that as an option in case you wanted to protect against device failure.