Re: x.25 link running HDLC does not need firewall?

Dave Killion wrote:

> <Disclaimer>
>
> I work for a firewall products company.  It makes sense for me to
> recommend firewalls.  It doesn't necessarily mean this is a bad idea.
>
> </Disclaimer>
My disclaimer is that I've been involved in implementing IPsec.

> Generally it's not practical to be overly concerned about the x.25 link
> itself - the phone company has fairly right control over these things.

That depends on your data. A link between a bank and a stock exchange
might carry some high value transactions. To me, it seems obvious you
ought to encrypt it for your customers' privacy and you ought to use
strong authentication mechanisms. Tapping an X.25 line is not hard.
I am not sure if injecting bogus data is difficult. My guess is that
you have a business requirement to render it impossible.

> It's the endpoints that need examining.  I would strongly suggest
> firewall-like controls at any ingress/egress points to your network.
> You have zero control over the security of the stock exchange servers,
> and therefore need to be protected from them.

I agree completely with that paragraph. I just suggest that you should 
talk to your opposite number at the stock exchange and see if you can
encrypt the link as well.