Our PCI auditor has said that ACL's and vlaning between test/office/production (cardholder) etc networks are not sufficient, and that we will need firewalls. However at a PCI conference we were advised that ACL's and vlaning were sufficient.
ACLs are not enough protection from our experience with auditors and compensating controls.
VLANs are a sufficient method of segmentation at layer two. You do not require physical separation of your POS network at this layer.
However, at layer 3, you do need a stateful firewall. ACLs do not suffice.
On a side note, Truth is a interesting word, from a compliance perspective. I have heard from retailers that, in general, Audits can vary from QSA to QSA. So, ultimately, I would advise you to work with your auditor to know their version of "truth" and if you believe that they are not being realistic, consider speaking with another QSA. In this particular case, I think you will find that the answer will be consistent across QSAs that you will require a true firewall.
You may also need to be concerned with where you are using VLAN's as wheather they are sufficient. If the vlan seperates a public internet segment and a segment with POS, that will probibly not be sufficient. If the MAC table gets overloaded the switch may go into full forwarding mode merging the internet and POS traffic compromising your systems. An overload loke this is not as likely when VLAN'ing private segments. And in any event the Internet traffic would not be merged with private traffic.
The PCI spec does specifically mention stateful "firewalls". We were successful in presenting a 6509 with VLANs for layer 2 segmentation, with the firewall feature set on the MSFC providing stateful capability. It took a bit of discussion, though. I think the auditors in general expect, and are more comfortable with, physical separation.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...