Well... Assuming you don't allow all traffic through the tunnel, a L3
firwall helps immensely to contain the threat locally.
So use VPN to provide access to AD/exchange services at central site,
port 80/443 to intranet portal... This is a very limited number of
ports.
If you just have a VPN appliance with no L3 firewall capabilities, you
have one big fat open pipe across the enterprise.
I agree that you are still at risk even with a L3 firewall, but not as
much as having straight IPSEC tunnel.
Am I missing something?
Steve Goldsby
-----Original Message-----
From: Matt Bellizzi [mailto:matt.bellizzi@nokia.com]
Sent: Wednesday, June 22, 2005 2:05 PM
To: Steve Goldsby (ICS)
Cc: Rodrigo Blanco; pen-test@securityfocus.com
Subject: Re: Risks associated to branch office IPSec devices
And a layer three firewall would prevent this how? Unless you have an
application level firewall your still at risk here.
Matt Bellizzi
Nokia Enterprise Systems
SQA Engineer IP VPN Group
ext Steve Goldsby (ICS) wrote:
First time someone brings in an infected file or downloads something
with malware on it from the internet, watch the entire VPN-connected
enterprise meltdown.
We saw an ENTIRE STATE network do this.
Steve Goldsby, CEO
Integrated Computer Solutions, Inc. -- 334.270.2892 www.integrate-u.com
/ www.networkarmor.com A Democracy cannot exist as a permanent form of
government. It can only exist until a majority of voters discover that
they can vote themselves
largesse out of the public treasury. -- Alexander Tyler Scottish
Historian
-----Original Message-----
From: Rodrigo Blanco [mailto:rodrigo.blanco.r@gmail.com]
Sent: Tuesday, June 21, 2005 3:01 PM
To: pen-test@securityfocus.com
Subject: Risks associated to branch office IPSec devices
Hello list,
I have just come across a doubt about branch office VPN devices.
Normally, they are used so that a branch office's network - typically
with a private addressing scheme - can securely connect to the
headquarters' central network.
Such VPN devices normally do not include a firewall, so I was wondering
if this really represents a risk:
Yes - it is a risk if the VPN device just acts as a router (no ACLs)
and is attached to the Internet.
No - because the addressing scheme behind it is private, hence
non-routable, hence unreachable across the Internet (internet routers
would drop packets with such destinations?)
The only real risk I see is if the VPN device is cracked, and from
there the security of the whole network (both brach office and
headquarters) is exposed. Am I right?
Any ideas would be more than welcome. Thanks in advance for your advice
and best regards,
Rodrigo.
