One of the major concerns in connecting computer networks via the Internet is the security risks. In enterprise class networks which consist of multiple sites or business units which are spread across the geography, connecting inter-sites into a single corporate network typically established via the public network – the internet.
Internet connectivity is normally provided via a perimeter router (and a secured firewall) connecting via an Internet Service Provider (ISP). Some Internet connections may be provided via broadband solution using xDSL or cable by establishing a VPN encrypted tunnel.
Due to the high security risks associated with the Internet a number of basic security procedures must be developed and should be followed by all the corporate sites. Any site communications over the Internet must be securely encrypted (VPN), and any Internet connection must be fire-walled with a suitable security policy to protect internal corporate assets. See also guidelines in securing the firewalls.
The following lists the minimum requirements with regards to Internet Security when connecting multiple sites into a single corporate network:
- All sites data communications over the Internet must be encrypted using VPN.
- Any entry point of the Internet connection must be fire-walled with a secured policy
- If using a perimeter screening router then it must have a suitable security policy to function to block non-authorized Internet originated traffic.
- All the routers must also be secure from common Internet hacking techniques.
- A suitable firewall must also be used to restrict inbound (from the Internet) Internet connections but allow authorized return (established) connections. See also basic guidelines in Cisco access list.
All sites or business units’ data traversing a public network such as the Internet must be encrypted. A strong encryption policy (VPN) must be used to protect network traffic from data manipulation and eves-dropping attacks. See also internet security threats.
The internal network must be protected with a firewall and if using a perimeter router (dual defenses) then it must also be configured to protect the internal network (and itself). This can be achieved by the use of a correctly configured extended access-list to block inbound (from the Internet) non-authorized traffic. Care must be taken not to block legitimate VPN traffic or valid established sessions.
The router should have SNMP disabled on the external Internet connection. It should be using strong SNMP and password security, with all TCP and UDP small-services (including http) disabled. Telnet restrictions should be enforced such that IP management is only allowed from authorized (internal) addresses.
Have a look at the above diagram; the two sites are connected via public network (the internet) by establishing a secured tunneling (VPN). The firewalls are hardened by configuring firewall policy. All the perimeter routers are configured with strong extended access-list security policy.
By not adhering to this standard, the internal network is capable of being readily compromised from the Internet. This includes such security threats as information espionage, data manipulation, device tampering and message masquerading.
See also:
- Guidelines in information security management
- Types of wide area network technologies
- How to calculate route summarizations
- Guidelines in routing – basic guidelines
- Router connection guidelines
I am having problem with the first link. It gives a 404 error?
Thanks