Should you run firewalls inside your network perimeter?

Question

The age-old question. I've seen responses go both ways on this, but never a comprehensive answer as to why you want firewalls active within your trusted network. When I say "trusted", I (typically) mean a LAN that is already behind an active firewall.

I'd like to have comprehensive reasons as to why you would want this. The only argument I've ever heard of is that firewalls inactive within your trusted network lead to a "crunchy-chewy" security arrangement, where breaching the "crunchy-hard" exterior firewall exposes all of the "soft-chewy" internal machines.

Answer 1

I think having firewalls within the network is a good thing for a variety of reasons.

1. Protect your sensitive internal data from being modified/stolen/deleted. If every end user in your company has network access to all of your production database servers, passwords are all that protect your data. In some cases (sql accounts vs. domain accounts) it's common for the entire development staff to have the write access password on all of these db's. Most of the statistics I've seen indicate you're far more likely to be attacked from within than from an outside attacker. Disgruntled employees can be extremely motivated.
2. Protect your sensitive internal data from being accidently modified/deleted. Accidently pointing a Stage web server at a Production DB server happens way more often than you'd think. If you firewall off your Prod DB servers such that only prod web servers and DBA's can reach them, you mitigate this risk significantly.
3. A more robust, layered approach. The more layers of sensible security you add, the better. Some people can go a little crazy with this, but overall this is a good idea.
4. As your network gets larger you need protection from yourself. Be it rogue access points, or laptops, its almost impossible to be 100% confident that everything on your network is conforming to your security policy.

Answer 2

Yes, simply because with just an firewall at the border, you have a single point of failure. If that firewall has a bug that allows it to be bypassed, then your security is gone.

Security should be a layered approach, applying security at each layer whenever it is possible, or at least cost effective, and appropriate for the level of risk.

As with all security advice, you should take into account the actual risk involved if your system was compromised. If all you would loose is a non-critical box with no data then it may not matter all that much. If you are trying to protect state-secrets, bank accounts or health care information you need to employ a lot more layers.

Answer 3

Never underestimate the ability of another employee to bring their virus laden laptop from home and plug it into your backbone, either.

Answer 4

Running a firewall on a internal server lets you control what services are really used and prevents misusages.

For example, you have a solaris server intended to be used as a NFS server only. Then one day you discover that some users have discovered that they are able to connect to it using telnet/ssh/rsh/X and have started to run their seismic job on it ...

Answer 5

One way of looking at this is:

You company has some kind of perimeter security, right? Ie, a gate house with a fence, etc.

Think of this as your main firewall.

Still, you lock buildings, you lock off sections of buildings, and you lock individual offices etc. If you have badges that you scan, some peoples badges don't even let them get into sections of some buildings, let alone into individual offices.

Each of those locked sections is like another firewall.

If you are going to use firewalls you as your protection you should think of having them isolate sections of your network from each other. You should not assume that a packet is good just because it is inside your perimeter.

Answer 6

Well that depends how much trust you put in your "trusted" network... By default in a very classic network configuration, your network edge is sufficient.

Let's say you have a big trusted zones with all your web/client/nfs/... servers. If one gets hacked, it will be able to access every single server to infect them and spread chaos on your network.

I strongly believe you need to have a VLAN for each functional group (one per client, on per web architecture) and all the communications out of each VLAN need to be filtered by a firewall. This allows you to isolate security-wise all of your functional groups and avoid crashing all of your company.

Speaking from experience, the previous company in which I was working died because of this very matter. So yes it is usefu :-)

Answer 7

I've seen a few deployments of firewalls inside networks to guard a single host, and have personal experience with two. In both of these cases, the single host being protected was a legacy operating system running in a configuration that was "certified" and could not be changed (one for legal compliance reasons, the other to continue receiving support from the vendor).

Because the hosts exposed unwanted services to the network (and because, in one case, the host provided no good logging facilities for recording distinct TCP sessions-- something the Customer wanted to have) and because the configurations of the hosts were fixed, we opted to firewall the hosts with a dedicated firewall device (in one case a Cisco PIX, and in another a Linux-based computer running an IPtables firewall and a TCP proxy service).

So, if you've got legacy hosts "stuck" in a sub-optimal configuration you might consider deploying a firewall just to protect them.

Answer 8

How big are you? At a certain size (which will vary) you will likely it useful to separate accounts, payroll, HR and production servers from uncontrolled access from the rest of the company. (I'd love to give myself a pay-rise. Unfortunately, for some people that will go beyond wishful thinking.)

Answer 9

I work as a consultant in LAN, WLAN and security.

Mostly this question arrises when in need for a routing point for new VLAN/subnet.
My preference is definitely the firewall (if you know enough how to manage your firewall of course.

This adds security and reliability in a simple way

• a router forwards by default, a firewall blocks by default. This means that only necessary services will be permitted.
• router is not session aware, a firewall is session aware. This makes configuration of ACL a lot less burdensome.
• a firewall has easy logging about what he blocks, an ACL on the router mostly only gives counters. This enhances troubleshooting and visibility into your network.

The pay-off of course is that a firewall has for the this same reasons worse performance per dollar than a router or L3-routing switch.
For sure you should isolate all traffic that normally does not has heavy traffic outside its VLAN: guest internet, infrastructure from 3rd parties (HVAC, access control), DMZ, APs, VoIP, ...

Question is the traffic between standard client PCs and servers. If you run it throught a firewall, throughput should be considered. As well keep in mind that a firewall without IDP does allow or block certain services and does not look what happens inside this specific service.

So here we have to balance security vs. investment.

Right now, Juniper is launching a new series of firewalls with incredible performance, for reasonable price, which makes it possible to replace your routing core with a routing firewall. Have a look at the SRX series. This SRX firewall with Gb throughput does not cost more than routing switch of decent brand.

Answer 10

We run firewalls on all local workstations where I work and we view it as a "good thing", insofar as has been mentioned previously, some lunkhead could bring a personal laptop in that's infected with a virus or worm and release it into the `trusted' corporate network.

Running a solution like Symantec or McAfee, you can centrally manage the firewall rulesets on all clients to quickly respond to a fast-spreading worm, (then again, if you're a quick thinker on your feet, you can also create pre-set ACL's on interconnecting switches and routers within your LAN to potentially block a malicious code from spreading, once you know how it traverses a network.)

That being said, be advised that you MAY POSSIBLY run into application issues where your clients need to communicate with servers on specific ports, etc.

To summarize; Firewalls on XP, Vista, etc. workstations = good thing. Do not deploy onto servers, unless you're ready to document and tweak for clients connecting to applications.

Answer 11

A packet filter is not "security."

A comprehensive solution will definitely also filter traffic in an internal network, but that doesn't necessarily take the shape of a packet filtering firewall.

Inhibiting, e.g., traffic between clients to slow worm propagation can be a very good thing, but is best served by configuring it in your switches, or - if that's unavailable - just fixing all non-server IP-adresses to 0.0.0.0 in the clients' ARP cache.

Regarding incoming laptops, just giving them a non-routed WLAN where they have to VPN in to reach a virus-scanning proxy may be preferrable to having a packet filter between each network. 802.11x that only allows permanently installed workstations onto switch ports may actually provide for this and the previous points.

VLANs also do more than their share, for both security and performance. Not everybody has to talk to everybody else, and if you don't switch/route between them in the first place, you don't have to filter.

Answer 12

One of basic security principles is "least privileges". Someone (or something) only needs the minimum access/information necessary to do their job.

If you have a database that is only accessible by a web server, why would you allow every other server on your network to access it? Same applies to every other system...

So, you need a firewall in the perimeter and also the host-based firewalls on each system (iptables, pf, etc) to provide more granular control. That way if one system is compromised, it is going to be much harder for the attack to spread on your network.

Plus, if you have segments with different clearances you also need a perimeter firewall or at least a vlan in there (say separating a HR network from the dev one, or the DMZ from the intranet).

So, yes, there is a definitive answer :)