lol
|
| Author | Content |
|---|---|
| techiem2 Sep 14, 2008 9:53 AM EDT |
Quoting:However, Firewalls are built to protect from external threats, not internal ones. ahahahahaha Tell that to my boss at the college..... |
| moopst Sep 14, 2008 11:43 PM EDT |
@techiem2: Don't you know firewalls only need to block incoming traffic? That's what the XP SP2 filewall does - only block incoming. |
| techiem2 Sep 15, 2008 12:22 AM EDT |
lol. Yeah, there's obviously no need to block college students from accessing the faculty and staff subnets...I mean..they wouldn't mess anything up would they? |
| gus3 Sep 15, 2008 1:43 AM EDT |
It isn't the job of the students' firewall to keep the students out of the faculty and staff subnet. It's the job of the faculty+staff firewall to keep the students (and other unauthorized parties) out. If those two sentences are a spaghetti mess of semantics, I apologize. |
| techiem2 Sep 15, 2008 1:47 AM EDT |
Quoting:It isn't the job of the students' firewall to keep the students out of the faculty and staff subnet. It's the job of the faculty+staff firewall to keep the students (and other unauthorized parties) out. :) That was my point. The firewalls on the servers filter both ways, incoming and outgoing between subnets, the other servers, etc. so only authorized traffic can go through. That make sense? hehe. |
| gus3 Sep 15, 2008 2:33 AM EDT |
Not really, at least how I'm reading it. Why do you need redundant rules on both firewalls that say "block from student-net to fs-net"? Why not simply "block to fs-net tcp syn" (along with blocking other malicious TCP/UDP attacks in general)? It comes down to a "white-list" vs. "black-list" mentality. Creating a special case on the student-net firewall ("allow all outgoing except to fs-net") reveals "white-list" thinking. Whether in Mandatory Access Control or in Role-Based Access Control, this is a Bad Thing™. |
| techiem2 Sep 15, 2008 12:55 PM EDT |
I believe my boss goes by the rule of block everything then open up the ports and access that are appropriate incoming/outgoing/between subnets/etc. At least I know that's how the wireless is setup. I think he has the rest of the network setup the same way. I really need to get a good diagram of our network and how the firewall is configured on the various servers and such. |
Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]
Becoming a member of LXer is easy and free. Join Us!