Stateful Versus Stateless ACLs and L3 Versus L4 Filtering
The campus network usually doesn't have clean-cut notions of trust like the edge does. As you learned in Chapter 12, "Designing Your Security System," it is easy to call the Internet "untrusted" and your data center in your campus "trusted." There is a smaller gradient of trust between the data centers, user communities, and department-specific subnets, though. In Chapter 12 you learned that a smaller gradient of trust between two zones allows the security controls at the choke point between the zones to be lessened.
As a result, in most cases stateful firewalls aren't strictly necessary at choke points. Instead, stateless access control lists (ACLs) can be used on a router or L3 switch. This filtering can be done at L4 when the L4 information is easy to represent (as with an application that uses fixed ports) but must be done at L3 only when necessary (such as when an application negotiates dynamic ports).
Firewalls do become essential is some cases. When protecting the management network from the rest of the campus, they are recommended. Also, when protecting key applications from network attack, they can be valuable assets. For example, a stateful firewall can be appropriate in front of an accounting system.
Beware of installing stateful firewalls too close to the core of your campus because you will likely have a resulting firewall policy that is so open (to support all applications) that it might not be useful. In addition, a firewall near the core can have a disruptive effect on high availability (HA) and routing if deployed in your campus.
Continue reading here: Ethernet Switch Wtk
Was this article helpful?