I have always used the two NIC model and a router along with ISA Server when using SBS, but now that SBS 2008 has ISA removed and the two NIC model no longer seems to apply, what Hardware Firewall device do people use/reccomend ?

 

I was thinking of looking at the Cisco Pix 501 devices are there others worth looking at ?

Hi William,

 

just looking for a box to install the edge of the network to protect the Server & Clients against zero day attacks, Intrusion attacks etc, now that ISA is going to be removed from SBS 2008.

 

Been looking at the WatchGuard Firebox X range of Security Appliances, they seem to be very good and not too expensive.

 

 

 

Hi William,

 

A basic firewall really is not good enough with SBS 2008. You need a proper hardware firewall because it has to protect the complete network as SBS 2008 will only have 1 nic and no more ISA.

I am a bit concerned with the fact that to get webmail, mobile access, vpn etc you have to open ports up on the firewall to all.

Maybe im worrying un-necessarily, but with the two NIC set up i run a hardware firewall infront of the SBS, turn off file sharing and client for microsoft networks on what i call the DMZ NIC and make sure IIS is tied down as much as possible.

 

With the single NIC senario i am going to have to point the ports (smtp, https, rww, pptp etc) at the ip address of the SBS box and hope nothing goes wrong with packets bouncing around the LAN. This doesnt seem very secure to me?

 

The other thing i am looking at is some sort of SSL VPN box to connect to the firewall and run webmail, rww through that. Netgear do one for a few hundred quid.

 

Cisco PIX is still supported if you have a Cisco contract (only way you can get support). Modern alternative is the ASA5505 which is a good box.

 

Jake

You are worrying a bit much...  The only difference between a PIX and something like a dlink or linksys is the pix controls traffic both ways.  There's some hardware and support differences but in terms of how they operate there's not much difference.  The PiX may contain IDS/IPS and other things but the value of IDS/IPS is still questionable. 

 

With a two nic setup you still could have cross traffic due to the sbs mahcine in effect being a router.  The idea of packets bouncing around the lan is a fallacy due to the fact that any router takes only the traffic mentined in the rules and sends it only at the target machine.  

 

Honestly, for all my qualms about Windows design flaws, SBS is a good product.  Once you know the design limitations of the underlying codebase it's actually one of the most secure Microsoft products out there.  Put a router in front of the box..use port forwarding and be vigilant but not paranoid.  Setup correctly(which SBS makes it hard to screw up) and operated correctly(this is the most critical part) I have never had an SBS machinee get directly compromised or be the instrument of a network compromise.

I wasnt worrying too much about the make of firewall - we use Netgear DG834 in a lot of our installations.  It was more the whole issue of opening up port 443 to the entire world and hoping everything within the SBS box / network is secure.

 

To be fair we have never had a problem on an SBS box but i have had microsoft web servers which had a vunerability in SSL attacked, broken into and the registry played around with. That box was a managed box run by a big ISP with plenty of firewall protection etc and the only reason it got broken into was that microsoft decided to publicise the flaw before they put a patch out!

 

My theory on having an SSL vpn box is to try and limit the amount of external traffic that needs to come any where near the network - its just an extra layer of defence to put in the way of people with too much time on their hands!

 

Jake

ok

 

do you use the built in vpn (eg pptp or l2tp) then or something else. I understood from a number of people that they thought the RWW was the most secure way of letting people have RDP access as it protected the network from the remote pc but i am open to ideas

Hi William,

 

No, you are not right with saying you need the rdp port open for rww to work. RWW only needs 443 and 4125, nothing else. RDP traffic in itself is encrypted.

I never said rdp wasn't encrypted..i said it's encryption is suspect. There are several programs out there that can easily crack rdp's encryption. 443 is https and 4125 is the rdp port. rdp gets sent over 4125 and https goes over 443.  As i said if they routed the rdp traffic over 443 i would have no issues. 

 

I have not seen anything about rdp inside of 2k3 that lends me to say it's a secure protocol.  Until the encryption of rdp 6.0 is properly vetted by independent cryptanalysts it's record and therefore the rdp protocol itself is not trustworthy.