Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Blue

CSS Best Practices for Security

We have CSS-11501s in our DMZs (separate ASA interface) doing load balancing for our public Web servers. There is a new server load balancing requirement on the internal network. Technically, I see no problems with using separate ports and VLANs on the existing appliances, but I am wondering if this would pass a network security audit?

Any documents or references to support this kind of configuration would be appreciated.

Dave

3 REPLIES
Bronze

Re: CSS Best Practices for Security

Hi dave,

Personnaly i wouldn't take the risk, because the css does operate like a router. So if somebody can force the routing so that the css is the next hop then everybody can connect to the internal vlan because the css routes unknown traffic. You could stop this kind of abuse by using acls on the css, but again that's not really approved by cisco.

Hope this helped you,

Dimitri

Blue

Re: CSS Best Practices for Security

Dimitri,

I understand what you are saying, but the only people with access to change the default gateway on a server would be an admin, and the worst that would happen would be to break connectivity. The server would then bypass the firewall for an internal connection, but the internal host response would route normally resulting in the firewall sending a reset due to the connection not being in the state table.

Dave

Cisco Employee

Re: CSS Best Practices for Security

Dave,

you should maybe post your question to the security forum

If you create an inside network and a DMZ protected by firewall there is a reason.

If you allow a device [css or router] to bypass the firewall, you create a higher risk of potential attack.

Maybe a TCP connection would not be possible, but what about attacks using icmp or udp ?

Gilles.

173
Views
0
Helpful
3
Replies