If an internal firewall is being deployed, it must be verified to ensure that corporate cores services are not restricted
In multi sites organization which is l inked together via the WAN, the use of internal firewall protection within the corporate is not encouraged. Internal firewall protection systems should be avoided due to the potential risk in affecting the corporate core network services and applications. If an internal firewall protection is to be used then it must be configured accordingly as to not impede network services (eg. corporate Active Directory and Exchange Messaging) which are deemed critical to the operations of the corporate global network.
If an internal firewall protection system is being deployed then its firewall policy configuration must be verified to ensure that corporate cores services are not restricted. An internal network is defined as a network internal to the corporate and/or its associated business units. This consists of trusted networks either between or within a registered corporate business unit.
An internal firewall protection system (optional) may be used to protect assets within and between corporate business units. If an internal firewall protection system is used, its security policy must not impede critical (core) services used within the corporate. This is a mandatory requirement so as not to block the corporate Active Directory traffic (AD, DNS, DHCP, WINS, and NTP etc.), Terminal Services and Exchange messaging. These services are fundamental to the operations of the global network.
Other background services such as Windows NetBIOS RPC (Remote Procedure Calls) and routing protocols must not be filtered by an internal firewall. This to ensure that full IP-network connectivity exists as well as providing support for the corporate services.
The individual security requirements (protocol and ports) that must be allowed through any “internal” firewall protection system within the corporate network must be appropriately configured.
Firewall protection - internal firewall connection
The corporate network monitoring services must not be restricted. The corporate utilizes a number of monitoring systems to govern the operational health of the network, for example the use of Statscout and NETIQ monitoring systems. These systems should be securely located within the corporate network and are responsible for monitoring the state of the global corporate network.
Suitable testing of the internal firewall protection system must be carried out to ensure that the corporate and monitoring services are not disrupted.
The following is the minimum requirements of the internal firewall connections with regards to firewall security standards.
1. Network Address Translation (NAT) cannot be used to separate corporate Active Directory infrastructure.
2. Ensure that the following core services are not restricted by internal firewalls:
a. Active Directory (AD) traffic (including RPC’s)
b. Terminal Services (Remote Management)
d. Dynamic Host Configuration Protocol (DHCP)
e. Windows Internet Naming Services (WINS)
f. Network Time Protocol (NTP)
g. Access to corporate member servers (NetBIOS connections) must not be impeded.
h. Corporate Exchange messaging services must not be restricted.
3. Corporate network monitoring systems must not be restricted. This includes both Statscout (SNMP) and NETIQ
4. The corporate routing topology updates must not be restricted.
5. Other corporate network services (such as SQL, SAP, and Citrix) must be appropriately configured.
6. Any other security measures that meet corporate business unit requirements can be implemented (if an internal firewall is being used).
7. Sufficient firewall testing and validation must be carried out to ensure that corporate connectivity requirements are addressed.
By not adhering to the internal firewall configuration guidelines, a business unit risks crippling multiple (inter-related) corporate network services. This includes both corporate active directory and Exchange messaging systems. Care must also be taken to ensure that internal firewalls are configured correctly to permit access to core services, whilst still serving the business unit security policy requirements.
Besides the previous discussion about firewall topology, read also the next series of firewalls security standards – External connections, all in-bound Internet connections to the organization internal network and / or standalone personal computer must pass through a firewall. Red more detail here!
Recent Comments