> -----Original Message----- > From: [email protected] [mailto:cisco-nsp- > [email protected]] On Behalf Of Roland Dobbins > Sent: Friday, October 09, 2009 12:06 AM > To: Cisco-nsp > Subject: Re: [c-nsp] ASA Firewalls placement in the network! > > > On Oct 9, 2009, at 11:39 AM, zafar ullah wrote: > > > What you guys suggest, which is best approach for robust & scalable > > secure network? > > Firewalls have no place in front of servers at all. They add no > security value at all, and make the servers behind them vastly more > vulnerable to DDoS, as well as greatly increasing the attack surface > if so-called 'protocol inspectors' are enabled. Server access > policies should be enforced via a mixture of host/OS/app BCPs and > stateless filtering via ACLs in hardware-based routers.
So are you actually saying that DPI is a bad thing relative to server protection? What makes this a bad idea? In what way does it make them more vulnerable to attacks? My experience with crafted packet attacks (being attacked, not attacking others :P) tells me that this is a good layer of protection. <sarcasm> What Arbor product would you like to sell me to accomplish this type of protection?</sarcasm> > > Firewalls do make sense for protecting access LANs for enterprises. > Firewalls deployed for this purpose must by definition be placed > behind the enterprise edge router(s) and in front of the internal > enterprise access network. > Ok... So it's ok to protect end users from the Internet? Gotcha. Not trying to be snide here (at least not anymore ;P), but I doubt that the majority of CFOs would be fine leaving their servers behind simple ACLs. I would never do that. - Brian _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
