Using Your Policies to Create Firewall and VPN Configurations

Topics in this chapter:

Introduction

As we learned in the previous chapter, securing your network starts with creating various security policies that articulate the rules, requirements, standards, and recommendations specific to your environment. As our businesses depend more and more on networks and the resources they provide, it is increasingly important that we protect these resources from unauthorized access, attacks, and exploits against vulnerabilities. As security professionals, our success is not dependant on fixing these inherent and ongoing problems, but relies on our abilities to select, implement, and configure solutions that protect our resources. The threats, attacks, and abuse will always be present as long as we have networks and provide services on those networks. It all starts with written security polices, which are our roadmaps—and the single most important documents you can have. Whether it is an Acceptable Use Policy, Remote User VPN Policy, or the Perimeter Access Policy, each will have a long-term impact on the security of your network.

Unfortunately, security policies are afterthoughts in many companies. It is not uncommon to find companies that have selected a security product, vendor, or even a complete security solution without ever writing a security policy. As a result, the security posture of these networks is ineffective in many respects. Their configurations and rules probably do not reflect the requirements or desires of the organization. In other situations in which security policies are not an afterthought, it is common to find that those policies are outdated and probably had little or no impact on the product selection or configurations of their security solutions. The most successful organizations with respect to strong security have a commonality between them—security policies. They review, update, and leverage best practice security principals when selecting and configuring their security solutions.

Another area commonly overlooked is security policy sponsorship. As important as developing the policies themselves, it is equally as important to get sponsorship for their content and implementation. This helps drive and support the entire process you will go through when creating, maintaining, and implementing your security solutions. Many organizations spend the time, resources, and money to create security policies, and fail to support them after their initial creation. Their failures are usually not a result of their efforts or even part of the original plan. Many recommendations and policies never get implemented or enforced long term because of two key missing elements: sponsorship and acceptance.

Sponsorship is key because it provides the support by someone who has authoritative power in the organization to oversee your success. This entire process is largely a team effort and without a sponsor, it will become challenging and often difficult to complete all the steps necessary to develop and implement the organizational policies.

Equally important is the acceptance and understanding from the entire team on the project goals and charter. While it might be impossible to always get 100 percent from everyone on the team, everyone must agree to support the team decisions and help enforce the policies. This is an area in which facilitation skills have a major impact. Helping lead others to understand the positive impact the policies will have on them personally will aid in their long-term support. If an individual or group of people does not general accept or believe in the goals, why would they support them? Finally, keep in mind that everyone on the team should have input and understand his or her participation is critical to the success of the project.

This chapter discusses how to take your written security policies and convert them into logical security configurations. Logical security configurations are used by technical administrators to guide them through the implementation and configuration of your firewall and VPN devices. You might be thinking that we have yet to discuss a specific firewall or VPN appliance. Well, you are right! In fact, this is a mistake commonly made by security professionals when they go through this step. By abstracting vendor-specific technology or features, you are able to think about the goals of the policies versus writing policy around a vendor’s product. This step might seem somewhat insignificant; however, it is a vital step that should not be overlooked or skipped. The primary goal of this chapter is to create concise and clear objectives that are specific to actual configurations of the firewall and VPN devices.

What Is a Logical Security Configuration?

Once you have developed and received approval for your written security policies, the next major step is to convert them into logical security configuration documents. You might ask, what is a logical security configuration and how is it different from an actual configuration you will create for your firewall or VPN device? This is a great question, and one that is might or might not be easily answered. Logical security configurations are documents that interpret written security policy requirements and define configuration requirements for a specific type of enforcement device, like a firewall or VPN products. Based on standard capabilities of these various devices, these documents will be used to build device-specific configurations that ultimately enforce your policy requirements.

For example, a firewall device provides access control between different networks to which it connects. At a basic level, they will provide these controls from Layer 3 and layer headers, which include source IP, destination IP, source port, and destination port. Even though you might select two different firewall devices for your network, this information will be important as the administrator configures the device. Keep in mind that we are not discussing or using actual features found in a specific vendor’s product or solution offerings. Instead, we are creating a logical configuration that will map our written security policy to the common capabilities of these devices.

While there is not a definitive correlation of logical configurations to written policies or logical configurations to specific devices, it is important that you create documents that can be easy to maintain and have focus. As a result, we recommend creating logical configurations for each group or type of devices you will be using in your environment. For our example, Example Corporation, we have created the following five categories and will create a logical configuration for each of these groups.

■ Firewalls

■ VPN

■ Workstations

■ Servers

■ Routers

Once our logical configurations are complete, we should have a series of documents that accurately represent the rules, policies, configurations, and procedures that will be configured on the specific firewall and VPN devices in your organization.

Planning Your Logical Security Configuration

Now we are ready to start the planning phase of our logical configuration process. It is recommended you complete the following four steps before starting the actual writing of your logical security configuration documents.

1. Identifying network assets.

2. Profiling your network assets.

3. Creating security areas.

4. Assigning network assets to security areas.

Keep in mind, once you capture some of this information, it can be leveraged in each of the logical configuration documents we identified in the previous step.

Identifying Network Assets

One of the first steps is to identify the network assets we are trying to protect and provide secure access to or from. It is important to understand what devices and services are on the networks you are protecting. The more information you capture about your assets, the more informed you will be when you have to make decisions. This information will be useful when you create your logical security policies and for ongoing management and auditing of your systems and...