Firewall Security Guidelines

Question

I'm looking for some best practices or Security guidelines for Firewall and VPN. Trying to study a little more about network security and write a sort of decalogue (set of rules). Usefull to follow when implementing a new system. Any ideas?

Thanks.

Answer 1

• Start with a two-way deny-all, then only add allow rules when a) requested, b) documented, c) reviewed by someone else and d) review their validity every quarter/6-months/year/whatever.
• Syslog and retain every deny for at least a quarter.
• Try to only allow through standard ports.
• Ensure all FW actions are authorised and audited.
• Dependant on volume maybe use Splunk to analyse where your denies are coming from, can be useful but can get expensive.
• Document everything to within an inch of its life, there's nothing as horrifying to new sysadmins as an undocumented FW.