View
314
Download
2
Category
Tags:
Preview:
Citation preview
Secure Network Design
Jose David Garcia
Index
1. Diagram Legend2. Layered Network Design
1. Access Layer2. Distribution Layer3. Core Layer
3. High Availability and Load Balancing4. Modular Network Design
1. Management Block1. Out of Band Management2. In Band Management
2. Server Block3. Wan Block4. Internet Block
Diagram Legend
CC
NIDS
HIDS
VPN
Router
Switch
Multilayer Switch
Load Balancer
Terminal Server
Firewall
Server
Management Console
Remote User
Network Intrusion Detection System
Host Intrusion Detection System
Virtual Private Network
Crypto Cluster
Switch Block 1 Switch Block 2
Internet Block
Wan Block
Server Block
Management Block
C C
IDS
VPN
IDS
VPN VPN VPN
IDSIDS
IDS
IDSIDS
Access LayerSwitch Block 1 Switch Block 2
VPN
Internet Block
Wan Block
Server Block
Management Block
Characteristics
• Low Cost per port
• High port density
• Uplink to higher layers
• Layer 2 Services
Security Design
•Identity based network services
•Vlan and Pvlan segregation
•Rate Limiting
•Management encryption
•Physical isolation
Best Practices
• Ports without need to Trunk should be set to OFF rather than AUTO
• Limit each port to a limited number of MAC addresses (5)
• Configure Storm Broadcast control
• Turn off Telnet and limit SNMP access to the Switches
• Logging to external server
Distribution LayerSwitch Block 1 Switch Block 2
VPN
Internet Block
Wan Block
Server Block
Management Block
Characteristics
• Aggregation of Access Layer Devices
• High layer 3 throughput
• Robust layer 3 functionality
• Security
• Media Translation
• QoS
Security
•Access Control List
•Span ports for IDS
•Physical isolation
Best practices
• Turn off unneeded services• Disable all unused ports• Limit the Mac addresses on a port to known MAC
adressess when possible (no trunking ports)• For trunking ports use a dedicated VLAN identifier• Eliminate native vlans for 802.1q trunks• Turn off Telnet and limit SNMP access to the
Switches• Logging to external server
Core LayerSwitch Block 1 Switch Block 2
VPN
Internet Block
Wan Block
Server Block
Management Block
Characteristics
• No Expensive Layer 3 Processing
• Very High Throughput
• No unnecessary packet manipulation
• Resiliency
• High Availability
Security
• Physical isolation
Best practices
• Disable all unused ports
• Limit the Mac addresses on a port to known MAC adressess when possible
• Turn off Telnet and limit SNMP access to the Switches
• Logging to external server
High AvailabilityLoad Balancing
HIDS
Management Block
NIDSNIDS
Key Devices
• Firewalls
• NIDS and HIDS
• IDS Hosts
• Syslog Hosts
• SNMP Management Hosts
• Cisco Works, HP Open View
• System Admin Host
Out Band Management
• Preferred method of management
• Isolated from production network
• Physical Isolation
In Band Management
• Only management traffic
• Different address space than Production Network
• NAT
• Encryption (IpSec, SSH, SSL)
• Firewall Security + IDS
Best Practices
• Only use In band Management when necessary.
• PVLAN segregation among hosts in management block.
• Periodic log revision
• Configuration base-line establishment
• Periodic base-line checking
Threats Mitigated
• Only use In band Management
when necessary.
• PVLAN segregation among hosts
in management block.
• Periodic log revision
• Configuration base-line
establishment
• Periodic base-line checking
• Unauthorised Access
• Man in the middle attacks
• Network reconnaissance
• Packet sniffing
• Compromised host hoping
• Hacking attempts going unnoticed
Server Block
NIDS
NIDS
NIDS
HIDS
Key Devices
• Firewalls• NIDS and HIDS• NTP Server• TACACS+ Server• Certificate server• Secur-ID Server (Strong authentication)• Corporate Servers• Call Manager• DNS Servers• E-Mail Servers• Etc…
Best Practices
• Firewall and NIDS implementation• PVLAN Isolation for each Server• Host Based IDS on each Server• Service redundancy• Backup Policy• Logging to an external server in the
mangement module• Version Control
Threats Mitigated
• Firewall and NIDS implementation
• Host Based IDS on each Server
• PVLAN Isolation for each Server
• Service redundancy• Logging to an external
server in the mangement module
• Backup Policy• Version Control
• Unauthorized Access• Ip Spoofing• Application Layer Attacks• Trust Exploitation• Compromised host hoping• Packet Sniffing• DoS• Hacking attempts going
unnoticed• Lost Data
WAN Block
C C
NIDS
Key Devices
• Firewalls
• NIDS
• Crypto Clusters
• Routers
Best Practices
• Data encryption
• Access List implementation
• High Availability thru different providers
Threats mitigated
• Data encryption
• Access List
implementation
• High Availability thru
different providers
• Data theft
• Man in the middle
attack
• IP spoofing
• Unauthorized access
• DoS
Internet Block
VPNVPN VPN VPN
NIDS
HIDS HIDS
Key Elements
• Firewalls
• HIDS and NIDS
• VPN Concentrator
• HTTP Servers
• DNS Servers
Best Practices
• Security policy with ISP to mitigate DDoS
• Private VLAN Isolation among Servers
• No corporate Servers at this point
• High Availability thru diferent ISP
• VPN for Remote user Access
Threats Mitigated
• Security policy with ISP
• Private VLAN Isolation among
Servers
• Firewall, NIDS and HIDS
implementation
• High Availability thru diferent
ISP
• VPN for Remote user Access
• No corporate Servers at this point
• IP Spoofing
• Packet Sniffing
• Compromised host hoping
• Hacking attempts going
unnoticed
• DDoS attacks
• Unauthorized Access
THE END
Recommended