Firewall

[Dechen Dorji]

                Firewall
 
 An organization has two server computers and several desktop computers, a few printers (IP address:) and routers (IP address: ). All of them are connected via an internal network, and the network is connected to the Internet via the border router of the organization. From the outside of the organization, on the Internet, only these two server computers are visible. One of them is the email server (IP address: ), and the other one is the web server (IP address: ). In other words, only these two server computers accept requesting incoming network traffic. All desktop computers (IP
address: ) are allowed to access the Internet, without any restriction. Therefore, they accept responding incoming network traffic, but cannot accept any requesting incoming network traffic. 
 
•  Please design the network and draw the network diagram. You have the freedom to assume the internal network structure. In the diagram, in addition to the two servers, you should also include a few desktop computers and a printer. Please explain the rationale on why you put a computer or a printer in its designated location, one
example for each location. A sub net (or a segment) is regarded as the same location. (Hint: a firewall or a few firewalls, depending on your design, are needed to regulate the network traffic. 
Please write down the firewall rules to fulfill the access requirement of the organization. Please write down the firewall rules for regulating the network traffic of your IT infrastructure.
 
 

[Dechen Dorji]

Need Help 

[Aref Alsouqi · Accepted solution]

Dechen, what you are asking is a mini project work that would require a lot of time to get it done :). Usually we segregate the segments of the desktops from the servers. You mentioned two of the servers would need access from the public internet, so those ones should be placed into a DMZ segment where you will then configure the firewall with the right NAT rules and security policies to allow the inbound traffic. The printers can be located in the same subnet as the desktops, however, some customers might prefer having the printers placed into their own segment (VLAN).

[Dechen Dorji]

Thank You for valid informations. Will try that way. 

[Aref Alsouqi]

You welcome.

[Dechen Dorji]

This is the Network Topology i have design. Hope its as per the requirements. Please help me to get it done. Thank you.

[Aref Alsouqi]

Looks very good. The only thing I would do differently would be to place the DHCP/DNS/AD server in a separate VLAN and then I would turn off any routing on the core switch to allow the firewall to be the routing engine so it can enforce the security policies. For example, if you separate the AD server in a separate VLAN and you leave the routing enabled on the core switch then that means any traffic from the workstation VLAN can hit the AD server, unless you apply access lists on the core switch SVIs which is not really practical nor recommended. However, when you turn off the routing on the core switch, then any traffic between the workstation and the AD server VLANs will be flowing through the firewall where you have all the security policies applied. In that case you can be very specific on which traffic you want to allow from each direction. For example, the workstation VLAN will be allowed DNS, SMB, DHCP, FTP, SCCM, etc, and if needed you can define what traffic should be allowed from the AD server towards the workstation VLAN. When the routing is moved to the firewall instead of the core switch, the workstation endpoints and the AD server will be using the firewall interfaces as their default gateway, same as the servers in the DMZ segment. Also, as a best practice I would remove any SVI on the core switch with the exception for the SVI that will be used for management unless you use the dedicated management port on the core switch.

[Dechen Dorji]

Thank you for your prompt response. Really appreciated. So what i understood from your above is that, if i separate the AD/DHCP/DNS  from existing topology then i have to create one more VLAN in firewall for that server, Right?. So that means in total i will have 4 VLAN in firewall and it will  act as gateway for all the networks(VLAN).

Further,i would love to see more comments and advice or more reliable Topology to strengthen my network. 

Thank You.

[Aref Alsouqi · Accepted solution]

You are welcome. Yes that's right, you would have four interfaces/segments on the firewall, one for each VLAN. Please keep in mind that on the firewall you don't necessarily have to have any VLAN reference for those segments on the firewall interfaces. For example, for the DMZ and internet interfaces you just create two normal interfaces and you assign the IP to each related segment. For the inside and the servers (AD/DNS/DHCP), you can create two sub-interfaces with the VLAN IDs, or you can create two separate interfaces one for each segment. However, that depends on how you want to connect the firewall internal segments to the switch. If you want to use a single trunk link then you have to have the VLAN ID reference on the firewall, but if you want to connect each of the firewall interfaces to a separate port, which is not common for the internal segments, then you don't have to worry about the VLAN ID reference.

[Dechen Dorji]

Thank you so much. And i would be very grateful if you could kindly help me to set/explain firewall rules for above topology. Thank you for kind help.

[Aref Alsouqi]

You welcome Dechen! I think we can take this similar to the topology, if you can please put the draft in of those policies, and I'll be super happy to feedback on them.

[Dechen Dorji]

Thank you. your response is always appreciated. So below are the policies and configuration been made. Therefore, i would further appreciate if you could help me and amend the necessary polices as per the requirements. You are great Sir.  

ASA (Firewall) (outside connected to Ethernet0/0,inside connected to Ethernet0/1 and the DMZ connected to Ethernet0/2):

!
interface Ethernet0/0
description Connected to Outside Segment
switchport access vlan 1
!
interface Ethernet0/1
description Connected to Inside Segment
switchport access vlan 3 , vlan 4
!
interface Ethernet0/2
description Connected to DMZ Segment
switchport access vlan 2
!
interface Vlan1
nameif outside
security-level 0
ip address 202.144.128.209 255.255.255.248
!
interface Vlan2
nameif dmz-server
security-level 70
ip address 192.168.2.1 255.255.255.0
!
interface Vlan3
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan4
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!

object network inside-subnet
subnet 192.168.0.0 255.255.255.0
object network dmz-subnet
subnet 192.168.2.0 255.255.255.0
object network webserver
host 192.168.2.4
object network webserver-external-ip
host 202.144.128.210
object network emailserver
host 192.168.2.3
object network emailserver-external-ip
host 202.144.128.211
object network dns-server
host 192.168.1.50

!
access-list outside_acl extended permit tcp any object webserver eq 80
access-list outside_acl extended permit (?????)any object emailserver eq (?????)
access-list dmz_acl extended permit udp any object dns-server eq domain
access-list dmz_acl extended deny ip any object inside-subnet
access-list dmz_acl extended permit ip any any
!
object network inside-subnet
nat (inside,outside) dynamic interface
object network dmz-subnet
nat (dmz,outside) dynamic interface
object network webserver
nat (dmz,outside) static webserver-external-ip service tcp www www
object network emailserver
nat (dmz,outside) static emailserver-external-ip service (......)
access-group outside_acl in interface outside
access-group dmz_acl in interface dmz
!
route outside 0.0.0.0 0.0.0.0 202.144.128.214

[Aref Alsouqi]

Looks good, just a couple of things I would say. Given that the AD server is now segregated in its VLAN3, I would enforce some security policies on the traffic passing from the inside towards that server, otherwise if all is allowed the segregation won't make much sense. If you like this idea, then you should change the VLAN3 interface name to something else, and remove the global command on the ASA that would allow the inter traffic between VLAN3 and 4 as both have same security level. The other thing is related to the DMZ segment dynamic NAT rule. You wouldn't need that as you have two static NAT rules for the two servers you have in the DMZ segment. Although it won't hurt having that dynamic command applied, I would personally remove it.

[Dechen Dorji]

Thank you so much for your kind informations/directives. I really love it. But I would like to request you to help me with some policies that need to be made. Your help will be highly appreciated. Thank you 

[Aref Alsouqi]

Glad I could help and please feel free to come back with any further questions.