External/DMZ Switch Management

[absmith9195]

How do you recommend managing switches that are external to a firewall. We have a switch on the external side of our firewall that I would like to be able to connect to with snmp and also use TACACS, NTP, remote syslog, etc. Would it be better to give it in IP in the physical (read: external) subnet, or put one of the ports into a separate vlan and connect that port to the internal segment. It seems as if the latter is insecure as it crosses boundaries, but I'm not sure. Thanks.

[grant.maynard]

You could give it a public IP but no default gateway, and again it will only talk to devices on its local subnet i.e. your NATed addresses.

Also disable unneccessary services and add ACLs to vty, snmp. Be careful to tie down the security.

Or you manage the internet router you could use a private (RFC1918) address and add that as a secondary address to the internet router. As a private IP it will not be reachable from the internet side.

[a.kiprawih · Accepted solution]

Hi,

Since you mentioned about external to firewall, the very least setup is a switch connecting your firewall outside interface to external devices like internet router and vpn boxes.

On firewall side, you need to static NAT address of TACACS/NTP/SNMP/syslog server to a Public IP to be reachable from outside, specifically by the switch. Create an ACL (or add to existing) strictly permitting the switch (via its public IP) to reach specific services like TACACS (tcp 49)/NTP(udp 123)/SNMP(udp 161/162)/Syslog(udp514) to your internal server(s).

On switch side, you can assigned public IP to the switch with all access authentication be default pointing to internal TACACS server's Public IP (NATted in firewall). Your aaa configuration must point to your internal ACS server.

Cisco recommendation on switch, especially when you placed it outside firewall, is more or less similar to the steps to secure your router. It talks about securing access to the box, managing/limiting services, flood and so on. Read the Cisco doc on how to secure router for a reference:

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

http://www.nsa.gov/snac/downloads_cisco.cfm?MenuID=scg10.3.1

Rgds,

AK