Perimeter security - firewalls and IPS/IDS
Requirement / business driver
Enforce policy and inspect traffic at boundaries (internet edge, DC, inter-zone) with the right mode, features, and placement.
Firewall deployment options
Routed vs transparent is the data-path mode (becomes a gateway, or inserts at L2 without re-IP); virtual (multi-context) and clustered/HA are scaling/availability options that combine with either. NGFW features: NAT, application inspection, security zones, PBR, TLS inspection (Transport security and encrypted-traffic implications), user identity (AAA and identity - RADIUS, TACACS+, 802.1X), and geolocation.
IPS/IDS placement
- Inline (IPS) - can block, but adds latency and is a failure point (plan fail-open/closed + HA).
- Passive / SPAN (IDS) - detect only, no blocking, zero data-path risk.
- TAP - passive physical copy; like SPAN but no switch oversubscription risk.
The server edge - two-tier and three-tier enforcement
Public-facing applications get their own enforcement architecture, separate from the corporate internet edge. A small estate runs two-tier (web front end plus a combined application/database host behind it); once the data entrusted to you gets serious - payments, finance - the design becomes three-tier: web, application, and database as separate tiers, each boundary a policy point. The enforcement pattern is strict adjacency: the internet may initiate only to the web tier on its published ports, the web tier only to the application tier, the application tier only to the database - and nothing skips a tier or moves laterally, with stateful inspection carrying the return traffic implicitly. The tiers can be built with a firewall per boundary, but a single multi-leg firewall pair enforcing all three boundaries costs far less and loses almost no security benefit - the isolation lives in the policy between legs, not in the chassis count. What each boundary buys is a blast-radius cut: a compromised web server holds no data and can speak only one contract forward, so the attacker must re-earn each tier. Augment inside a tier with private VLANs so peers cannot talk sideways (Layer 2 security).
NIDS/IPS economics - placement is a tuning decision
Sensor placement is usually argued as coverage; it is really tuning economics. In front of the firewall a sensor sees the raw internet and drowns in noise; the closer a sensor sits to the systems it protects, the fewer traffic types it sees, the easier it is to tune - and only a well-tuned sensor can be trusted to block rather than merely alarm. Tuning is the make-or-break: the first pass removes what is not an attack - management traffic (suppress those alarms for the management sources, accepting the spoofed-source caveat that ingress filtering mitigates) and benign-but-unknown protocol chatter - so that what remains is actionable. And the operational truth belongs in the design: a firewall enforces policy even when nobody watches it; a detection-only sensor does nothing without a monitored console - so an IDS commitment is a 24x7 operations commitment (or an outsourced one), and where that staffing does not exist, prefer fewer, well-placed, well-tuned inline sensors over broad unwatched coverage.
Recommendation / justification
Place firewalls at trust boundaries; pick transparent to insert without re-IP, routed to also be the gateway/segmentation point, multi-context for tenant/zone separation, and clustering for throughput+HA. Run IPS inline where blocking is required (with HA/fail strategy) and passive where you only need visibility. Justify by the boundary's role, throughput, and tolerance for an inline failure point.
What would change this (mid-scenario twist)
- Insert a firewall into an existing subnet without re-addressing -> transparent mode.
- Multi-tenant DC -> multi-context (virtual) firewalls; high throughput + HA -> clustering.
Validation checks
- Is each firewall at a real trust boundary with the right mode and HA?
- For inline IPS, is the fail-open/closed behaviour and HA defined?
IPv6 / dual-stack note
Inspect and enforce policy for v6 equally; a v4-only ruleset with v6 permitted is a frequent gap.
Related
- Threat detection and mitigation - DDoS, spoofing, MITM
- Transport security and encrypted-traffic implications
- AAA and identity - RADIUS, TACACS+, 802.1X
Spaced repetition
Routed vs transparent firewall in one line each: routed = [...]; transparent = [...].
Routed vs transparent firewall in one line each: routed = L3 hop / gateway (own IPs); transparent = L2 bump-in-wire inserted without re-IP.
IPS inline vs passive: inline [...]; passive/SPAN/TAP [...].
IPS inline vs passive: inline can block but adds latency and is a failure point (needs fail strategy + HA); passive/SPAN/TAP detects only, no data-path risk.
Multi-context firewalls primarily provide [...]; clustering provides [...].
Multi-context firewalls primarily provide multitenancy (separate logical firewalls on shared hardware); clustering provides scale-out throughput + active/active HA.
Three-tier server-edge enforcement in one rule?
Strict adjacency - internet -> web (published ports only), web -> app, app -> DB, nothing skips a tier or moves laterally; a single multi-leg firewall pair enforcing every boundary loses almost no security over three chassis, because the isolation is the inter-leg policy.
NIDS placement is really [...] - closer to the protected systems means fewer traffic types and a sensor tuned well enough to block; a detection-only sensor [...].
NIDS placement is really a tuning-economics decision - closer to the protected systems means fewer traffic types and a sensor tuned well enough to block; a detection-only sensor does nothing without 24x7 monitoring.
Sources
- Cisco Press, Network Security Architectures (Convery) - two/three-tier server-edge enforcement, NIDS placement and tuning doctrine.
- Cisco Press, SCOR; Cisco Secure Firewall design guides.