Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Best practices for firewall external interface addressing

Hi all,

Can anyone explain what is more secure when addressing the outside interface of a firewall in a network diagram?

1st option:  

                          ISP router:

                               interface 1 (connected to the internet).

                               interface 2 to the firewall with public ip address.

                           Firewall:

                               interface 1 (connected to the router): public ip address

                               interface 2 (connected to internal network): private ip address (RFC1918)

2nd option:

                         ISP router:

                              interface 2 (connected to the internet (ISP)).

                              interface 1 to the firewall with private ip address (RFC1918).

                         Firewall:

                             outside interface 2  (connected to the router): private ip address (RFC1918)

                             inside interface 1 (connected to internal network): private ip address (RFC1918)

Any response is welcome.

Everyone's tags (3)
4 REPLIES
Hall of Fame Super Blue

Best practices for firewall external interface addressing

It's not so much what is more secure as where you want to do the NAT and how may public IPs you have.

So if you only has a small block of public IPs and you wanted to use them for NAT on the firewall then you could use a private link between the ISP router and the firewall.

Usually though an ISP gives you two blocks, a /30 for the point to point link and then a larger subnet for actual use on the firewall.

For a single ISP setup doing the NAT on the firewall is usually the way it is done especially if you are using VPNs as if you NAT on the router it can interfere with the VPN.

If you end up with multiple ISPs then you may need to move some or all of the NAT configuration to the routers although it is not always necessary and you may still do it on the firewall. It depends on a lot of other things such as IP addressing, ISP advertisement of public IPs etc.

Jon

New Member

Best practices for firewall external interface addressing

Thank you jon.

Hall of Fame Super Silver

Best practices for firewall external interface addressing

Option 2 is more secure because it will break the network for most use cases.

Option 1 is necessary assuming your firewall is the device that performs NAT for outbound traffic. It is also necessary if the firewall also provides either site-site or remote access VPN services as you need a public IP to access it for those functions.

A firewall is by design hardened against public attacks. If you want to further reduce the attack surface you can filter unwanted ports at your upstream router but that incurs administrative overhead and introduces the risk of more errors in configuration thus compromising availability in a different way.

New Member

Best practices for firewall external interface addressing

Thank you Marvin.

295
Views
0
Helpful
4
Replies
CreatePlease login to create content