Using a Cisco PIX Firewall to Limit Outbound Internet Access

Transcription

1 Controlling Outbound Internet Access by Use of a Proxy and Firewall A WHITE PAPER PREPARED FOR ASPE TECHNOLOGY toll-free:

2 Controlling Outbound Internet Access by Use of a Proxy and Firewall ABSTRACT This article describes an effective network design for limiting and controlling access to the internet, using a Cisco PIX firewall and an internet proxy server. The relevant networked devices are introduced, and the roles of each device in providing an integrated internet security system are explained. The system that is described is effective in protecting private resources from internet hackers, as well as controlling the types of internet resources that are made available to private LAN users. INTRODUCTION Traditionally, the role of a firewall has been to limit access to private servers from internet client applications. The firewall design usually allows nearly unlimited access to the internet for private users, while totally blocking connections from the internet to private corporate resources (this is the default Cisco PIX behavior, for example). However, the real world has introduced several scenarios that do not fit into this simple firewall model, and thus more flexibility is needed. These scenarios include: 1. Some corporate servers actually SHOULD be reachable from the internet. These include web servers used for e-commerce, servers handling internet e- mail, internet domain name servers, etc. 2. Some corporate users do not need internet access, and should not have it. 3. Usually, a large number of internet sites are inappropriate for all corporate users, and should be blocked from all computers on the internal LAN. 4. The firewall does not monitor internet usage, in terms of which users are connecting to which sites. 5. The firewall may not cache the contents of popular internet sites locally, which would enhance performance and ease WAN congestion. The goal of this document is to explain how to add these features to a firewall setup. FIREWALL SETUP Figure 1 shows the setup of the firewall relative to private users and the internet. The firewall is the connecting point for three types of networks: 1. The internet rabble (totally public); 2. The corporate network (totally private). 3. The Demilitarized Zone (DMZ) networks, which are neither totally public nor totally private.

3 Figure 1 Basic Firewall Setup Some PIX models allow the network designer to specify several DMZ ports, which allow total physical separation between devices with intermediate (semi-private) security levels. These devices would be e-commerce servers, web servers, FTP servers, mail servers, domain name servers, etc. Without this feature, all DMZ devices must be placed on one single LAN which is connected on the outside interface of the firewall. The separate DMZ ports provide a more secure physical setup, and Figure 1 above shows this configuration. The role of the PIX is to limit connections (at level 4 of the OSI model, the TCP level) to only those allowed by the PIX administrator. The administrator will define security levels for all networks connected to the firewall, i.e. several DMZ ports are defined with different security levels. This allows more sensitive DMZ devices to be protected at a higher level. For example, the firewall may allow a mail server on a particular DMZ port

4 to talk only to another (private) mail server on the private LAN, but not to any other resource (except, of course, mail servers on the internet). The most important function of the firewall is to block connects from the internet to the private corporate LAN. If a server needs to be accessible from the internet, it is connected to a DMZ port, where limited connects from the internet are allowed. PROXY SERVERS While the firewall blocks inbound connects from the internet, additional functions are required. The primary role of the proxy server is to limit (or at least monitor) the internet usage of corporate users. The following classifications of material (and possibly others) may be considered inappropriate by network management: 1. Violence and racism; 2. Paramilitary and weapons; 3. Hobbies and recreation; 4. Travel; 5. Pornography; 6. Games; 7. Chat Rooms; 8. Newsgroups; How does one limit access to these types of sites? The solution is to install a proxy server on the private LAN. For the WWW browsers on the corporate LAN, the proxy server is the internet. First, the firewall is programmed NOT to allow any connects from the corporate LAN WWW browsers directly to the internet. Instead, only WWW connects from the proxy server to the internet are allowed. When users start their browser (probably from an application server), a script is executed which allows the internet user to be identified by the proxy (the browser essentially logs in to the proxy). The proxy either allows or disallows internet access for this user. If access is disallowed, the browser may only be used to connect to WWW servers which are on the private side of the firewall internet servers are not accessible. Access to private servers may be allowed on several levels, totally unlimited, or limited based upon a class of user group. If internet access is allowed, each connect request from a corporate user to the proxy is matched against a database of allowed or disallowed sites. The databases are commercial products, obtained from the internet by subscription (generally, updates to this database are downloaded by the proxy server on a daily basis). Any attempt to connect to a restricted site is logged in the proxy by username and/or IP address, time, and web site. The nature of the restricted database may change by time of day, the user, and other factors. For example, users in the accounting group may be allowed access to CNN Financial during business hours, where the engineering group may not. After hours, all groups are allowed access.

5 The proxy provides other benefits. The contents of popular internet sites are cached to proxy disk, so that subsequent connect attempts do not have to be routed to the internet. This can dramatically improve the performance of web applications. Besides the WWW application, other applications (such as FTP, Gopher, Telnet) etc. may also be passed through the proxy. Proxy software packages are available for all of the major OS and browser types, from various software vendors. Figure 2 summarizes the firewall/proxy setup, and also shows the proper position of various public and private servers. Note that, in some cases, it may be necessary to create holes in the PIX to allow connects to inside resources, but the number of these holes should be held to a minimum, as they compromise security. For example, it may be necessary to create a hole in the PIX to allow the outside mail server to connect to the inside mail server, and the DNS servers may need to connect to each other as well. Cisco calls this hole a conduit. CONCLUSIONS For many networks, the ability of the firewall and proxy server to work together to provide a save environment for the business or institution is a critical consideration. A recent federal law stipulates that all public schools must provide filtering capabilities to restrict the types of sites that students may visit (this is likely to be challenged in court). For many businesses, productivity and focus of employees is essential, and firewall/proxy tandems can meet the goals of corporate management in this regard. To be secure, these systems must be configured and connected in a manner consistent with manufacturer s intent. A network which is thought to be secure, but is not, is perhaps more problematic than one which is not protected at all.

6 Internet Internet Router E- Commerce PIX Firewall Internet Mail Internet DNS Private Mail Corporate Router Corporate (Private) LAN Private WWW Private DNS Proxy Figure 2 -- Firewall/Proxy Tandem Setup