Firewall Deployment - Security Zone, Security Policy, Address Book, RVI, VLAN, Subnet, App Traffic
In this video, I will discuss Enterprise Security Architecture and various concepts related to network and network security within that architecture. For example, VLANs, access ports, routed VLAN interfaces, firewall security zones, security policies, and address books. So, let's begin.
These are two laptops and two printers. We want to send a print job from these laptops to these printers. However, in an Enterprise architecture, these laptops won't communicate directly with the printers. Instead, we will use a print server and an Administration server for device management, such as the print server by IT admins.
To ensure network security, we will use a firewall between these devices. All devices will be connected to different physical ports on the firewall using Ethernet cables.
Initially, these devices cannot communicate because all traffic on the firewall is denied by default. We need to explicitly configure the firewall to enable communication. Our goal is for the laptops to send print jobs to the central print server, which will then forward the commands to the printers.
Additionally, the Administration server will manage both the firewall and the print server, possibly by system or Windows admins.
Firstly, we will assign different IP addresses to all devices from different subnets: one for laptops, one for printers, one for the Administration server, and one for the print server.
Next, on the firewall, we will define two VLANs: one for laptops and another for printers. Laptops' ports will be configured in Access mode to carry traffic for a single VLAN (VLAN ID 2 for laptops, VLAN ID 3 for printers). Laptops can communicate with each other but not with printers, and vice versa.
We will then define the routed VLAN interfaces (RVI) for the laptop and printer VLANs. The RVIs will have IP addresses from their respective subnets. These interfaces facilitate communication between different subnets.
For the print server and Administration server, we will assign IP addresses but won't configure RVIs. Ports connected to laptops and printers will operate at Layer 2 in Access mode, while ports connected to the servers will operate at Layer 3 with IP addresses.
After defining these Layer 3 interfaces (either logical or physical), we will define four security zones, corresponding to the four different networks: laptops, printers, print server, and Administration server.
Each zone will have an address book defining remote networks (e.g., laptop subnet, printer subnet) to explicitly allow traffic between them.
For the Administration zone, we will configure inbound SSH traffic to allow firewall admin access from a specific IP address only, enhancing security.
Finally, to allow traffic between different zones (e.g., from laptops to print server to printers), we will configure security policies. These policies specify which traffic (e.g., SMB for printing, TCP 631 for internet printing, TCP 389 for RDP) is allowed between specific source and destination address books across the firewall.
In conclusion, in firewall configurations, everything must be explicitly defined to ensure network security.