Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In designing a campus network how would you distribute your firewalls

I have designed a university network with 2 campuses. They use a leased line to link the two campuses. There is a firewall on the internet edge as well as a firewall on each of the WAN edges. Each of the network edges have redundant switches and thus redundant firewalls. There are several firewalls protecting our sensitive data. Most questionably there is a firewall in every building.

I thought that this might be excessive. Is it important to have a firewall in each building as someone could gain network access from within a building?

As I understand it, the firewall in each building will not prevent someone from messing with another computer in the same building. But it would however prevent them send spurious traffic into our network core.

I don't think there is any argument around the need for firewalls on the internet edge or our sensitive data, but do I need one in each building and on the WAN edges?

share|improve this question

closed as not constructive by Sven, Khaled, Dave M, John Gardeniers, mdpc Feb 17 '13 at 3:43

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Is this a homework question? What kind of firewalls you need and where is entirely dependent on the security needs the organization has, there is no "right" way do do this. – Sven Feb 16 '13 at 14:02
It is a homework question. I recall there being a homework tag on stack overflow 2 years ago but the tag didn't show up when I posted this. – Jordan Feb 16 '13 at 16:17
up vote 6 down vote accepted

Firewall placement is less about network topology and more about securable asset location and risk vectors. As phrased, there isn't enough to go on in your question to recommend placement.

Anyway, the risk vectors that we need to be aware of and plan for:

  • The Internet connection
  • The WLAN; you did say University so this will be where J. Random Student will be using their own device on your network.
  • Publicly accessible hardwired network jacks (computer labs, libraries, possibly classrooms too)
  • The Dorm networks

You will need robust defenses fronting your Internet, Dorm, and WLAN connections. The WLAN will prove problematic since students are likely to need enhanced access to University resources not otherwise exposed to the Internet. The Dorm connection may actually be entirely separate from the University's normal internet connection, but will likely have a cross-connect (or a subnet-based passthrough) for Students to get at University resources similar to the WLAN network. Network jack re-use can be defended through port-based access controls locking access to a specific MAC address, no need for a firewall.

Additionally, you need to be aware of the securable assets that need to be cordoned off from routine access. These you already know, but...

  • Central ERP systems
  • Anything involving payment infrastructure (PCI-DSS stuff)
  • Core administrative services

These are big enough they're likely in their own security zone.

Where do you need firewalls? That depends on a lot. You can do quite a bit with simple router configurations (if buildings aren't accessible to each other, no need to firewall them off from each other). Do so intelligently, based on the overall risk picture and not just the network topology chart.

share|improve this answer
It is very easy to change the MAC of all current network cards I know, so "MAC authentication" doesn't go far. And perhaps the last categories contain resources that are critical enough to get their own firewalls. At an university, wherever grades are kept is a very tempting target... as is any course management system. Also use the local firewalls of current operating systems. – vonbrand Feb 17 '13 at 1:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.