Access rule vs. firewalls

In light of the recent viruses/worms that have have shown up on our network, the administrator in charge of our two Unix servers wants to restrict access as to who can get to the servers via what protocols, but he doesn’t want to put that overhead on his servers. Our group has been talking about access lists on the Cisco router vs. putting up a second firewall in front of just the Unix servers. Which would be the best way to go? – Via the Internet

In light of the recent viruses/worms that have have shown up on our network, the administrator in charge of our two Unix servers wants to restrict access as to who can get to the servers via what protocols, but he doesn’t want to put that overhead on his servers. Our group has been talking about access lists on the Cisco router vs. putting up a second firewall in front of just the Unix servers. Which would be the best way to go?

– Via the Internet

The answer depends on how much protection you want to provide for the servers. Using access control lists will control what protocols and/or ports can be used to get to the servers, but nothing else. You won’t have any logging as to when someone is trying to spoof an address or send a malformed packet, for example. This is an easy way to control access to servers but it does have its limits.

Using an interior firewall  gives you the logging that using just access rules may not be able to. You may be able to use syslog to send the alerts/errors back to a central console so you don’t have to check the firewall to see if someone has been doing something they shouldn’t. The next question is whether to use the same vendor’s firewall for your exterior firewall or use a different vendor’s product. What you need to consider is the ease of administration when you use the same vendor’s product for both firewalls vs. potential additional safety by using different vendors’ products matched against having to learn yet another firewall product. One of the arguments I have heard is if you use different vendors’ products for the firewall, if the first firewall gets compromised, the work to get past the second firewall will make them start all over since it is on a different platform and, theoretically, won’t have the same “vulnerabilities” as the first firewall. Either way, make sure you’re running the latest firmware for the routers to help this be an issue regardless of the vendor(s) you choose for the firewall(s).