Re: Layer 3 and Firewall

dubaisans dubai wrote:
> Hi,
>
> Is it a REALLY BAD idea to have multiple Firewall segments connected
> on the same 6509?
>
> I have a 6509 Layer 3 switch which connects the LAN , WAN and Server
> segment. This has three Layer 3 VLANs
>
> I plan to implement a Firewall [ either PIX or checkpoint] which will
> segregate  these 3 segments.
>
> On the Cisco 6509 I will convert the existing Layer 3 VLANs into Layer
> 2 and assign those IP[which is the default gateway for the respective
> segments] to the 3 interfaces of the Firewall.
>
> Firewall is managed by me[Infosec dept] while the switch is managed by
> Networking dept.
>
> My worry is - After i implement Firewall , if the network admin pulls
> out the Firewall cables and brings back the Layer 3 VLANs with those
> IPs then there is no Firewall.
>
> How can we tackle this risk ?
>
> What is the technical workaround. Is it a REALLY BAD idea to have
> multiple Firewall segments connected on the same 6509?
VLANs aren't the most secure way to separate segments because of VLAN 
hopping attacks.  On the Cisco you could make it a little more secure by 
implementing port-security but this can be a pain to manage if you have 
a lot of devices connected.  Have you considered installing the firewall 
services module in the the 6500?  This basically gives you virtual pix 
firewalls instead of using standard access-lists to control access 
between the VLANs.