RE: Layer 3 and Firewall

-----Original Message-----
Subject: Layer 3 and Firewall

Is it a BAD idea to have multiple logical segments of a Firewall connected
to the same physical switch?

It's not a good standard to adhere to because layer-2 VLANs can be hopped in
some cases by attacking the switch, but the level and type of vulnerability
will vary by implementation.

In fact, Check Point is designed so that you can have multiple virtual
interfaces on a single physical port by using 802.1q VLAN tagging.

The threat I see is if the network switch administrator wants to bypass
Firewall, he can just disconnect
the Firewall links and make the VLANs Layer 3 and there is no security.
After malicious activites he can
very well connect the Firewall and revert back to Layer 2.

This is a separate issue. If the switch admin is not in sync with the
firewall admin or cannot be trusted, then 1) yes this is a valid threat and
2) while a technical solution exists, the best solution to this specific
issue is to address these problems from a personnel perspective and either
reassign responsibility for those switches or replace the switch admin with
someone who is trustworthy.

Is that a valid threat ? Is it High risk ? What controls are possible ?
Are multiple physical switches
required.?

Probably the thing to do would be to research whether or not a workstation
on either VLAN can hop to the other with the current switch configuration.
You're going to want yersinia, Cain, arptools and another Cisco switch (a
2950 is fine for this) and see if you can flood or spoof your way to the
other VLAN. This is best done during a maintenance window or some time when
it's OK to disrupt the network.

PaulM



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: Layer 3 and Firewall
    ... while a technical solution exists, the best solution to this specific ... switch admin playing foul. ... Subject: Layer 3 and Firewall ... interfaces on a single physical port by using 802.1q VLAN tagging. ...
    (Pen-Test)
  • Re: Catalyst 3750 with 2 vlans. Only vlan1 drop packet when ping
    ... when I ping to the ip onvlan1, about 10% come back with "Request ... Are you pinging the hsrp vlan 1 address, ... ping vlan 140's interface with no problems? ... how does the other switch know how to get ...
    (comp.dcom.sys.cisco)
  • Re: Catalyst 3750 with 2 vlans. Only vlan1 drop packet when ping
    ... when I ping to the ip onvlan1, about 10% come back with "Request ... Are you pinging the hsrp vlan 1 address, ... ping vlan 140's interface with no problems? ... how does the other switch know how to get ...
    (comp.dcom.sys.cisco)
  • Re: Need guidance on Cisco 6513 install
    ... having this switch set up on Tuesday by noon, ... The switch itself (and other future network hardware) will be on the ... but you can always choose another vlan number and same ... In a two core environment, ...
    (comp.dcom.sys.cisco)
  • Re: bond interface arp, vlan and trunk / network question
    ... So far vlan and trunking works as expected. ... The exact problem is that the bonding driver don't switch the ... interface because the mii-tool don't recognize that the connection ... No, from your configuration information, you're running the ARP ...
    (Linux-Kernel)