Re: [fw-wiz] Firewall routing thought...

From: Gwendolynn ferch Elydyr (gwen_at_reptiles.org)
Date: 07/09/04

  • Next message: Melson, Paul: "RE: [fw-wiz] Pix - access list trouble?" 
    To: Dana Nowell <DanaNowell@cornerstonesoftware.com>
Date: Thu, 8 Jul 2004 19:17:27 -0400 (EDT)

    On Thu, 8 Jul 2004, Dana Nowell wrote:
    > Aaahhhh, if they are on the same subnet, why is the gateway involved at
    > all? Last time I checked, 10.1.1.1 (assume mask 255.255.255.0) talked
    > directly to 10.1.1.2, no gateway in the middle. There is an automagic
    > 'static route' that says 10.1.1.x is local to the segment.

    To quote myself:

    "... as soon as you make a change in broadcast domains, the router is
    going to be involved"

    I'm quite sure that your machine, at 10.1.1.1/24 somewhere in New Hampshire
    isn't talking directly to my machine, at 10.1.1.2/24 somewhere in Ontario ;>

    If instead, both of our machines were sitting at a conference together,
    connected to the [ethernet] switch in front of us, then yes - you'd
    expect that they'd be able to communicate directly - although not quite
    as you describe.

    -For ethernet- it's accurate to say that "all hosts in the same broadcast
    domain are able to use ARP to translate IP addresses to link layer
    addresses (MAC addresses) and vice versa, to allow direct communication
    within that broadcast domain". It's disingenious to describe it as
    an "automagic static route".

    It's also not true for all networking technologies.

    At any rate, this really boils down to "without knowing what the
    network of the original poster looks like, it's dangerous to
    make presumptions".

    Speaking of making presumptions, I've just realized, reading back over
    the OP's email, still more closely, that his concern is routing the
    networks that the firewalls are protecting, not between the firewalls
    per se, which makes most of this email a tangent.

    What he's really asking is whether it makes more sense to establish
    and maintain [static] routing tables on his firewalls, rather than
    set a default route, and let the router sort out what networks are
    where.

    In terms of performance, almost all firewalls handle routing decisions in
    software. The router handles the same decisions in hardware. The router
    is going to be faster[0]. It's the difference between taking the freeway
    or the back roads to a given location, presuming traffic conditions are
    clear.

    cheers!

    [0] This is the general case - I'm sure the list members can come up with
    ways to speed up software, and slow down hardware.

    > On Tue, 6 Jul 2004 13:50:18 -0400 (EDT) Gwendolynn ferch Elydyr penned:
    > >On Fri, 2 Jul 2004, Eric Appelboom wrote:
    > >> If one has firewall A with external ip on the same subnet as firewall B.
    > >> How common is the practice of adding static routes on firewall A for The
    > >> networks protected by firewall B and the other way round.
    > >>
    > >> Would this technique not lower the latency or overheads of not having the
    > >> packets en route from firewall A to firewall B being sent to its default
    > >> gateway to then be processed by the router and sent to firewall B. Thus the
    > >> traffic would be direct A<-->B
    > >
    > >I think you're a bit confused about how routing/routers work, and what
    > >the relative "costs" are.
    > >
    > >Your network layout isn't really clear from your email, but as soon as
    > >you make a change in broadcast domains, the router is going to be involved.
    > >
    > >> Besides being a tad messy would it be considered and at what traffic rate?
    > >
    > >Well - I generally wouldn't consider it at any traffic rate.
    > >
    > >First of all, it's not likely to improve your latency or overhead. The
    > >packets are still going to be seen by the router.
    > >
    > >Secondly, you've now added complexity to your network in the form of a
    > >bunch of static routes in different places, all of which need to be
    > >maintained - and almost certainly won't be, until some changes breaks
    > >things.
    > >
    > >"a tad messy" is almost always a signal to run away screaming. That's
    > >code for "unmaintainable" and "all-nighters".
    > >
    > >Ranting briefly, a good design should be clear and easy to understand
    > >and explain. If you find yourself handwaving, or muttering quickly to
    > >get past some point in your design [or adding in "here be dragons"],
    > >you should stop and figure out why.
    >
    > --
    > Dana Nowell Cornerstone Software Inc.
    > Voice: 603-595-7480 Fax: 603-882-7313
    > email: DanaNowell_at_CornerstoneSoftware.com
    >

    ==========================================================================
    "A cat spends her life conflicted between a deep, passionate and profound
    desire for fish and an equally deep, passionate and profound desire to
    avoid getting wet. This is the defining metaphor of my life right now."

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Melson, Paul: "RE: [fw-wiz] Pix - access list trouble?"

    Relevant Pages

    • RE: [fw-wiz] Firewalls v. Router ACLs
      ... people to take in consideration in network design and layout. ... here and the old firewalls list often emphasized an approach that avoided ... The logging alert features alone turn this layer into a IDS as ... > An appropriately sized router will not have any performance problems. ...
      (Firewall-Wizards)
    • [fw-wiz] Firewalls v. Router ACLs
      ... used firewalls to protect our part of the network from network ... 100% successful and we have not been impacted by the numerous network-borne ... We are now being pressurised to remove the firewalls by the rest of the company. ... A secondary argument is cost - the router is seen as a one-off purchase ...
      (Firewall-Wizards)
    • RE: HSRP with load balancing on a Cisco IOS based firewall
      ... Can I implement MHSRP across IOS based firewalls on Ciso routers? ... Split the network behind the Firewall into subnets say Network A and network ... Network A has router X as its primery and router Y as its secondary. ... My prelimnary research on HSRP gives me the understanding that in an HSRP ...
      (Security-Basics)
    • Re: local networking and firewalls
      ... you will need to open the appropriate ports in the firewalls on ... As for whether your router is an adequate firewall is hard to say. ... All computers, the printer, and the DSL modem connect ... > The network only functions if I turn off all Firewalls on the individual ...
      (microsoft.public.windowsxp.network_web)
    • Re: Using Remote Desktop From an SBS Domain
      ... After I thought about needing 3389 forwarded on my router to allow me to ... Remote Desktop "out" from a workstation on my SBS network to a host XP ... Hopefully next week I can attempt a connection while my ISP watches the ...
      (microsoft.public.windows.server.sbs)