Re: Use of VLANS between firewalls - good idea?

On Wed, 26 Jan 2005 12:57:30 GMT, Damian Gunner <dgunner@lycos.co.uk> wrote:
> One idea I had was for Firewall1 to have multiple NIC cards
> and the servers to be multi-homed - one NIC to Firewall1
> and the other NIC to a common back-end network connected to Firewall2.

The above is the approach I recommend and use.  IMHO, the primary drawback
(ignoring cost) to the "firewall sandwich" approach is the complex
routing tables
needed on each multi-homed host.  If Firewall2 is a proxy firewall or if it NATs
outbound traffic to always appear to originate from Firewall2 (rather than
exposing your internal private IPs) then this problem is greatly reduced.

See the current Firewall-Wizards discussion "[fw-wiz] Multiple
firewalls from different manufactureres" for more on this approach:
   http://seclists.org/lists/firewall-wizards/2005/Jan/index.html


> My worry is over how often I am seeing this to be a bad idea
> and that it is eacy to hop from one VLAN to the next.

The state of VLAN insecurity has improved greatly, but there are still
risks.  Different switch models from different vendors offer various features
to enhance intra- and inter- VLAN controls.

Kevin Kadow