Lesson 3: Common Mistakes and Best Practices for Designing Network Security Zones

Network Segmentation: Lesson 3
In this lesson, Professor Wool examines common missteps when organizations create security zones and best practices to consider for an improved defense.
Learn more about AlgoSec at www.algosec.com and read Professor Wool's blog posts at blog.algosec.com

[@arshidrashid598]

great job professor thumbs up. explained in a really simple way. thanks for sharing

[@zomgoose]

Great explanation! Thank you!

[@cottondai]

Great lesson. Thank you

[@johnson554671]

Man, I'd give you three thumbs up if I could! You explained things so well. Will check out your other vids!

[@AxionSmurf]

I don't think he wants your third thumb

[@dksmiffs]

Excellent video! Helpful to this networking greenhorn who's attempting to design an upgrade to my home network. Thanks very much.

[@davhernandez17]

Thank you! that was amazingly clear

[@obiobi5794]

great job! looking forward to browse the channel

[@leo-rq2ei]

great video thanks!

[@AxionSmurf]

Great video!

[@esthermdzitiro31]

Great explanation, thank you.

[@certifiedprogrammer4598]

Thanks professor you explained clear in it

[@aballesteros5425]

Hi @AlgoSec , at around 4:47 , the connection from the DATA-FW , APP-FW , WEB-FW to the MAIN-FW, are they on the same Network or same broadcast doamin ( eg. are all the Interface peering IPs are on the same /24) OR Do they have their own separate network?

[@vpcnetwork3181]

Is it possible to do Zones in one firewall rather then virtual firewall contents ?

[@rilcoeng]

Now the audio it's very nice

[@mingxindong3150]

Can we just have a switch between the firewall and servers, so we can have Vlan and separate the traffic.

[@jeffcojd]

If it's a layer 2 switch you can only have one VLAN through it, it's all on the same broadcast domain.

[@tempone1015]

You can use roas "router-on-a-stick" approach if u want to use an L2 switch for the servers, so u can have separate vlans in each server.

[@aaltameemi]

Yes, you can and this is the best option rather than creating virtual Firewall for each zone. Therefore, simply assign each App, Data, Web systems (phsyical or virtualized servers) into a switch and segreate between them using VLANs. Connect the firewall to the switch as a Trunk and create sub-interfaces, where each sub-interface tagged with a VLAN for each zone. Then in firewall assign each sub-interface into different security zone (Web, App, Data) and start configuring firewall rules between zones.

[@makistsiros2783]

And we are back to a single hw firewall box as a single point of failure no?

[@AlgoSec]

Thank you for you question
a) It's possible to use a virtual firewall if your organization prefers to avoid appliances: all major vendors have virtualized their products to work in both private-cloud or public-cloud environments. Also most vendors allow in-product virtualization (having multiple virtual firewalls inside one big hardware chassis).
b) All firewall vendors offer clustered high-availability solutions to avoid a single-point-of-failure situations (so do router vendors)
c) SDN and cloud platform providers (VMware, Cisco ACI, AWS, Azure, etc) all provide filtering capabilities within their fabric, which is another path to take
So you have plenty of options - and in all them the considerations I discussed in the video are relevant
.
I hope this answers your question.

[@ultimatums1]

This was nothing about best practices. more like different design examples.