Why Use Two Routing Processes in a Firewall ?

A com­mon prob­lem in Enterprise net­work­ing is that B2B con­nectiv­ity is reas­on­ably com­mon and for lar­ger organ­isa­tions a big prob­lem. You can have hun­dreds of external con­nec­tions. In times past, we tried to have mul­tiple fire­wall clusters to handle B2B, part­ner and other types of con­nectiv­ity, but this has caused secur­ity issues and net­work­ing prob­lems when the the Enterprise net­work core is very large.

More import­antly how­ever, we are now deploy­ing a lot of hard­ware, soft­ware and tools to secure, mon­itor and respond to all our external con­nec­tions and these tech­no­lo­gies (note 3) cost a really ser­i­ous amount of money. Having only one fire­wall cluster can be a means to reduce the cost and to improve secur­ity by need­ing to con­trol only a single point into the net­work. The dif­fi­culty is that by bring­ing all ser­vice flows in to a single place, you lose the sep­ar­a­tion of data flows.

Consider a fire­wall cluster as shown in the dia­gram below. Note that the fire­wall would be a HA pair but looks like a single unit.

The first to note is that the default route to the Internet is required for external access. The second area is a pair of redund­ant VPN con­cen­trat­ors that are host­ing per­man­ent IPsec con­nec­tions. The third area is the leased line con­nec­tions using Frame Relay, ATM or even ISDN.

VPN Concentrators

If you are using IOS as VPN con­cen­trat­ors, then you do not neces­sar­ily have auto­matic fail­over. (Note 1). So you might deploy two C7200 using HSRP, then con­fig­ure Reverse Route Injection to inject the routes asso­ci­ated with each VPN tun­nel. This then allows the fire­wall to for­ward traffic for an inbound VPN tun­nel to the cor­rect next hop in the event that a unit has failed. (Note 2). By redis­trib­ut­ing the static routes gen­er­ated by the RRI, you are then able to inject the VPN routes on to the firewall.

Leased Line

For per­man­ent ser­vices, part­ners often con­nect over Frame Relay but require an ISDN con­nec­tion as a backup. The fire­wall needs to have routes to advise which is the next hop for the external source in the event of fail­over. OSPF rout­ing from the Frame Relay and ISDN headends will allow for cor­rect rout­ing of packets.

Routing Security

So why not have a single pro­cess ? Because a user con­nec­ted on the VPN would see routes in the Leased Line Network. By sep­ar­at­ing the rout­ing pro­cess we can ensure that there is a ser­vice sep­ar­a­tion ( and this concept is approx­im­ately in line with com­mon secur­ity prac­tice). The pos­sib­il­ity that a VPN con­nec­ted organ­isa­tion could access the frame relay net­work is very real.

By sep­ar­at­ing the VPN con­nec­tion from the Leased Line con­nec­tions, we have cre­ated quite dis­tinct secur­ity zones on a single infrastructure.

CCIE Candidates might like to give some thought to mak­ing the OSPF more secure by restrict­ing the routes in OSPF Process 2 ? Could you use a stub area or a totally stubby area to restrict routes ? Obviously OSPF authen­tic­a­tion and encryp­tion is man­dat­ory. What about static defin­i­tion of OSPF neighbors ?

Some things to note

You should note that a mod­ern Enterprise fire­wall cluster would have more equip­ment than this. There are no proxy serv­ers, applic­a­tion fire­walls, IDS/​IPS, con­tent fil­ter­ing, web scan­ning, virus scan­ning etc shown in the dia­gram. These are usu­ally com­mis­sioned where the dia­gram shows “internal”.

For lar­ger Enterprise net­works, BGP peer­ing is neces­sary to determ­ine the next hop, Cisco ASA does not address this very well at well. However Juniper does.

Conclusion

This is a com­plic­ated topic and if you are read­ing about fire­wall design you will prob­ably have a load of ques­tions. Hopefully I have covered (for at least one design) why you would two OSPF pro­cesses. Leave a com­ment and I will do my best to answer.

Addendum

Note 1: Later ver­sions of IOS do sup­port state­ful fail­over of IPSec ter­min­a­tion points, but not all Enterprises are able to use latest ver­sion of IOS.

Note 2: This got a whole lot easier when HRSP track­ing was imple­men­ted but note that out­bound VPN rout­ing can be a prob­lem in this design.

Note 3: Consider the fol­low­ing virus scan­ning, IDS /​ IPS serv­ers and taps, log­ging (band­width for second­ing those logs), secur­ity pro­ced­ures and approvals and so on

Please rate this post:

(No Ratings Yet)

 Loading ...