Firewall policy formulation and Interaction for multiple business systems

Network Environment Description: There are three different vendors in the project, involving the interconnection of the three business systems and the joint debugging of network firewall policies. The three business systems are under the core Huawei 8508. The three business systems interact with each other, and they also have external data interfaces and business interconnection access.

Network Topology:
650) this. width = 650; "style =" width: 662px; height: 552px "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0Q10I0A-0.jpg "width =" 675 "height =" 552 "/>

Q: How can partners avoid repeated and invalid firewall policies when formulating firewall policies in project cooperation to ensure correct interaction and security between businesses? The following are my thoughts:

1. System Platform Architecture Establishment
First, the partner vendors should determine the system and platform architecture. In the project development process, the architecture design is involved after the requirement specification is completed, and the requirement specification must be recognized by the architect. Architects need to communicate with analysts repeatedly to ensure that they fully and accurately understand user requirements. Based on user requirements, the architect divides the system into smaller subsystems and components to form different logic layers or services. Then, the architect will determine the interface of each layer, and the relationship between the layer and layer. Architects not only need to perform vertical decomposition of the entire system, but also "horizontal" decomposition of the same logic layer. Through a series of system decomposition, the architect finally forms the overall architecture of the software. Technology Selection mainly depends on the software architecture. Establish hardware selection and related technologies based on the software architecture. For example, server type, operating system, Server Load balancer, cache design, and cluster.

2. Business Process sorting and server function Role Positioning
As business systems interact with each other, business process sorting is very important. The business strategy determines the business process, and the business process determines the processing architecture. Process organization must have clear goals and be closely integrated with specific services. For example, a processing module is to extract and integrate data, then, how to extract, integrate, and present the data depends on the Data Process, which is closely related to the subsequent firewall policy formulation. The sorting process aims to facilitate project development. It can better solve customer problems and clarify their goals through sorting out the process. In other projects, we simply sort out the process, especially when we come up with a comprehensive sorting. We have no idea why the sorting process is. This type of project is basically a result of financial losses and the consultant is tired, the customer is also tired of working with each other, and the entire project has no focus. The final project is a mess. After the business process is clear, the module can locate the server's functions and roles. Each server or server group can accurately locate the specific business processing data and how it is associated with other servers, which facilitates interaction and scope definition between business systems.

Third, IP overall planning
After determining the above two points, you can plan the IP addresses of the entire system and server. The number of private network segments and addresses required, the number of public network addresses required, VLAN division, HSRP, VRRP, and heartbeat, the number of network devices and servers, and the management address of the devices, these must be taken into account. Whether dynamic allocation or all static addresses are required, and whether NAT is required. You need to perform systematic addressing and pay attention to the subsequent scalability. Systematic addressing mainly refers to the systematic planning of the entire network address based on the specific business needs and process processing structure, so that the entire network structure is clear and the routing information is clear, the route table can also be reduced.

Fourth: Firewall policy formulation and Optimization

When the above conditions are met, we can easily develop firewall policies for our business systems. Establish the internal and external areas of the firewall and the DMZ area. Based on the IP address and service port of each server, consider the interaction factors between different business systems. Then, we can accurately Set firewall policies, at the same time, note that some policies are unidirectional and some are bidirectional. For server clusters implemented by Server Load balancer, pay attention to the access and release policies of virtual addresses. After the firewall policies of various business systems are set up, business detection and testing should be carried out, and corresponding optimization and adjustment should be made accordingly.

After all policy adjustments and optimizations take effect, we should not expect the firewall policies to provide you with robust security. The firewall can protect you from external direct attacks, but it cannot prevent internal attacks from the LAN. It cannot even protect you from all the attacks and unknown attacks that it can detect. In addition, security is multidimensional, and firewalls are only one of them. Under normal circumstances, you can use a lot of security measures to reject any dangers and attacks you know that are necessary and known and related to security. But the emergence of new vulnerabilities every day means security is always a constant battle.

 

Summary: The formulation and interaction of firewall policies for multiple business systems is a complex task. It requires not only your attention, but also your constant adjustments to face dynamic security.

This article is from the "dripping water and stone" blog and will not be reposted!