My company wants to explore some opportunities in Second Life. A preliminary study of network traffic indicates that there may be incoming UDP packets that are not associated with a prior outgoing request. Can you provide guidance on how to set up an enterprise NAT’d firewall to support employee access to Second Life?
— Peter Quirk.
When I hear things like this, I get concerned about the possible traffic coming in that isn’t in response to a response to prior outgoing traffic. Depending on your firewall and the additional expandability or the ability to add features, you may be able to pursue one or more of the options I will mention:
To start, I would suggest that you activate or install a DMZ connection in the firewall. Setup up several workstations using a switch connected to this DMZ interface. Until you can get a better handle on this additional “traffic”, it is in your best interest to segment the traffic and not allow it on to the main network. I would suggest that you use a separate public IP address and route that traffic to the DMZ interface. In this way, you can allow the additional incoming traffic to the computers on the DMZ interface and not endanger the workstations on your main network.
You can also establish a subnet on your network and route the traffic to that subnet without using a DMZ interface. I would not suggest this option because of the potential for some of the traffic to get to other portions of your network causing problems that you would rather avoid. No sense in inviting potential problems.
Even better is to have a separate broadband connection installed that is totally separate from your company network. You would still follow up with a firewall and switch for this “test” network. While this could be an additional monthly expense that may not have been planned for, it offers even more protection for your company. For those that are inquisitive, a traceroute back to the IP that is being used to connect to Second Life wouldn’t reveal who your company is. It also have the benefit as being able to serve as a backup internet connection if your main connection is down for some reason.
Whether you pursue the DMZ or separate internet connection options I have discussed, this situation presents an excellent opportunity for doing some testing of IDS/IPS solutions as well as other security type solutions to see if they should be incorporate in your main network without causing problems with important corporate traffic. You can also enhance your packet capturing skills as well.
