Home page logo
/

basics logo Security Basics mailing list archives

Re: Router Packet Filtering and Firewalls
From: Sean Smith <shmelty () yahoo com>
Date: Thu, 30 Jan 2003 12:44:12 -0800 (PST)

As far as the ISP being lazy... Even though they say
the service offered you is a managed router, in realty
all it is is setting up the routing and making sure
that it functions. As far as security, they like to
charge extra for the security management. What you had
before was a screened host setup and that is a nice
security scheme. You could go one further and put
another screening router behind your firewall and
create a screened subnet. You lucky you got them to
configre any filters for you. I asked AT&T to do that
for me, but they wanted another $400/month for each
router.

sean
--- Geoff Shatz <geoff.shatz () pchelps com> wrote:


I am trying to confirm my thoughts regarding the use
of router packet 
filtering in addition to having a firewall behind
the router but first a 
little background...

Years ago when we first connected our firm to the
Internet we did not have 
a firewall but used packet filtering on the router
to protect our 
perimeter.

As time progressed and security became a much
greater issue for everyone 
in IT we moved forward an installed a firewall
between our router and the 
LAN. I was managing our router at that time and kept
the initial packet 
filters in place as I figured two layers of security
were better than one.

A few years ago we were forced to switch ISP's and
our new ISP managed the 
router they supplied to us. They supplied the router
with no ACL's applied 
to either interface which as I understand it with
Cisco IOS creates an 
implicit permit for both inbound and outbound.

After contacting technical support I was told none
of their customers use 
packet filtering at the router level and that's what
a firewall was for.
I had a small battle with them but they finally
relented and configured 
the router the way I asked them to.

We just had a second circuit installed and I had to
go through the same 
routine with them and the end result was the same.

Am I missing something here? Is it not better to
have both packet 
filtering applied on the router and a firewall
behind it? Is there 
something inherently wrong with this or is this just
a case of our ISP not 
really giving a damn about security and on top of it
being lazy? Any 
comments would be appreciated.

-Geoff



__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]