Three Tier Web Design
Once your organization gets serious about e-commerce, you should probably think about a dedicated three-tier design to accommodate the security requirements of the sensitive data that is entrusted to you by your customers. This design basically separates the application and database servers, which were combined on a single platform in the two-tier design. Many financial organizations adopt a three-tier design, as do businesses with large e-commerce presences.
This design generally is separate from the corporate Internet access for employees and general applications such as mail. This separation is shown in Figures 6-24 and 6-25 from Chapter 6, "General Design Considerations." Remember also that this design affords certain flooding attack mitigation benefits, as shown in Figure 6-26 and discussed in the e-commerce-specific filtering section in Chapter 6. Although it is possible to implement a three-tier design with three firewalls as shown in Figure 8-8, using two firewalls as shown in Figure 8-9 is less expensive and loses almost no security benefit.
Figure 8-8. Three-Tier Web Design (Three Firewalls)
Database Server Web Server
Figure 8-8. Three-Tier Web Design (Three Firewalls)
Database Server Web Server
- AppliMlion Server
Figure 8-9. Three-Tier Web Design (Two Firewalls)
The firewall access control policies to implement this design are as follows. Only the HTTP-related portions of the ACL are shown. Content push and device management are not included here. Depending on your application architecture, the communication between web and applications and applications and database could be over any number of protocols. TCP 80 is assumed in these examples, as is stateful filtering.
Inbound on the FW-1 outside interface:
IPermit outside hosts to talk HTTP/SSL to the web server access-list 101 permit tcp any host 192.0.2.53 eq 80 access-list 101 permit tcp any host 192.0.2.53 eq 443 IDeny any other web traffic access-list 101 deny tcp any any eq 80 access-list 101 deny tcp any any eq 443
Inbound on the FW-1 perimeter interface:
IPermit web server to make requests of the apps server access-list 102 permit tcp host 192.0.2.53 host 192.0.3.12 eq 80 IDeny any web traffic access-list 102 deny tcp any any eq 80 access-list 102 deny tcp any any eq 443
Inbound on the FW-1 inside interface:
IDeny any web request (the apps server will only be responding to requests Ifrom the web server, since the firewall is stateful, this is automatically Iallowed where appropriate) access-list 103 deny tcp any any eq 80 access-list 103 deny tcp any any eq 443
Inbound on the FW-2 outside interface:
IPermit apps server to make requests of the DB server access-list 101 permit tcp host 192.0.3.12 host 192.0.4.8 eq 80 IDeny any web request access-list 101 deny tcp any any eq 80 access-list 101 deny tcp any any eq 443
Inbound on the FW-2 perimeter interface:
IDeny any web request (the DB server will only be responding to requests Ifrom the apps server, since the firewall is stateful, this is automatically Iallowed where appropriate) access-list 102 deny tcp any any eq 80 access-list 102 deny tcp any any eq 443
Inbound on the FW-2 inside interface:
!Deny any web request (the only traffic which should be allowed from the linside network is management and content push traffic. The method of doing !this is variable and is discussed in Part 4 of this book) access-list 103 deny tcp any any eq 80 access-list 103 deny tcp any any eq 443
4 PREV
NEXT t
Continue reading here: XEAP Protocol Details
Was this article helpful?
