Essential Firewall Hardening Guide

Printable View

March 23rd, 2005, 10:58 PM
aciscorouter

Essential Firewall Hardening Guide v.2

[glowpurple]UPDATED 03/24/05[/glowpurple]
:deal:
My self and a colleague put together a mandatory hardening guide for Network Firewalls for our company and with permission, we stripped out all references to the business and I now I'm making it available online. I was always looking for something like this and I know others could really use some guidelines, especially with compliance and auditing being so rampant lately.

I have two more to come soon - Network L3+ Router Hardening and Network L2 Switch Hardening (complete with Cisco how-to's for both IOS and CatOS).

Let me know what you think...
March 23rd, 2005, 11:20 PM
Tiger Shark

Damnably fine piece of work Sir..... and I don't say that very often....

A must read for many here...
March 24th, 2005, 01:04 PM
IKnowNot

I really enjoyed reading this, though very tough to get through as with each rule you propose and reasons behind them I try to think how I have used them in the past.

This is a definite must have reference.

My first thoughts when reading this are you should include a disclaimer: this is NOT for the novice!

Maybe it’s just me ( cynical as I am ) but I can see people flooding you with questions like “ I just installed my first copy of linux for my network firewall, set up my Iptables just like you said, but my LAN can’t connect ... by the way, why are there no FORWARD rules listed here? “

Just a few questions.

1) did I miss it? I did not see network protocols ( such as SMB, NFS, RPC, etc. ) listed here as not to leave the network. I realize they would be dropped by the default policy ( or I believe as you call them “ Base Firewall Filters “ ) but logging them specifically could show indications of miss-configuration and/or problems within. Am I off-base here?

2) did I miss this? I did not see blocking of things like XMAS or NULL packets. Any reason, as they can be used to detect hosts, open/closed ports, etc.?

3) My last question is, well, ... I don’t know. Why did you put Firewall Management Rules before Fragementation and Reassembly of IP Datagrams , etc. ? I know we ALL do something stupid now and then. Couldn’t this potentially cause problems?

Again, a good read and reference! Thanks!
March 24th, 2005, 02:58 PM
instronics

This is VERY helpful. Thx for sharing.

Cheers.
March 24th, 2005, 03:02 PM
aciscorouter

TigerShark: Thank you, I'm glad you enjoy... There's more to come...

IKnowNot: Thank you, you raised some really good points that I neglected to address. In my purpose I did mention that the intent was to define attack protection and anti-spoofing from the un-trusted to the trusted networks the firewall was intended to protect.

Our intent with this document at a corporate level was to address the firewall base protection rules to ensure the integrity of the firewall themselves. I did make mention of outbound rules but limited them since everyone of our environments have different needs. As an example, fragmentation over VPN is common and will exhaust the re-assembly buffers in a default configuration. Also, in a VPN block, we allow any RPC or NetBIOS protocol between our VPN clients and the corporate network. I didn't want to address these "content" rules as a basis for every configuration, rather we have been developing a Content Rule Guideline to address what are acceptable protocols and traffic patterns ingress and egress of our corporate infrastructure. I included the "Content Rules" section with the disclaimer that it was merely an example of how these protocols would be implemented.

Having said all of the above, I agree that perhaps for a general rulebase designed to provide base protection of the LAN and to block protocols that aren't designed to leave the LAN, I have to make a revision. This will also address rule order as you are correct, the fragmentation and anti-spoofing should exist before any connections are allowed for management purposes.

Last of all, I need to create a sub-category to address the Intended Audience.

I'll make some changes and repost the update later...
March 24th, 2005, 03:38 PM
aciscorouter

Quote:

Originally posted here by instronics
This is VERY helpful. Thx for sharing.

Cheers.

You're welcome instronics, can't keep it unless you give it away :D
March 24th, 2005, 03:46 PM
rowdy_yates

Hi. Very good stuff. !!!
March 24th, 2005, 04:47 PM
Danielsd

Perhaps stupid question, but how to open it? Word can't, notepad also? What to do?
March 24th, 2005, 04:49 PM
MrLinus

Uh.. try a browser. ;)
March 24th, 2005, 04:51 PM
Danielsd

MsMittens You are always so fast answering! Problem was that the browser is craching. But I found a way to read it! Thank you!
April 19th, 2007, 02:57 PM
crawdad101

Is the link for your firewall hardening guide gone, or am I blind?
April 19th, 2007, 07:18 PM
skiddieleet

Quote:

Originally Posted by crawdad101

Is the link for your firewall hardening guide gone, or am I blind?

I was wondering the same thing. I'm anxious to get it but don't see it. :(
April 19th, 2007, 07:24 PM
Negative

We noticed a while ago that attachments from before the upgrade have disappeared, and this is one of them unfortunately... Our only hope is that the OP sees this thread and re-posts it (if he still has it, as it is quite old) - his last activity was about a month ago...
February 9th, 2008, 06:45 PM
aciscorouter

Where did the .zip file go? Anyone know where I can find this? Haven't seen the attachment since the site was updated a year ago...
January 9th, 2009, 09:16 AM
ByTeWrangler

Alright.. sorry to bump up a *really* old thread.. but I've lost the attachment from the thread too.. Is there anyway to get it back ?
January 9th, 2009, 09:50 AM
t34b4g5

Quote:

Originally Posted by ByTeWrangler

Alright.. sorry to bump up a *really* old thread.. but I've lost the attachment from the thread too.. Is there anyway to get it back ?

Unfortunatly since the upgrade from the hacked vb2.0.0 attachements were not able to be brought over with the new vb3.x.x upgrade. :(

Maybe send a "PM" or email to the thread starter and ask if they happen to still have a copy..

If you need there email addresse then i can give you it via "PM" :)
January 9th, 2009, 10:21 AM
Cheap Scotch Ron

As an alternative....If you are looking to harden a cisco (ios) router, this is a decent book...

http://books.google.com/books?hl=en&...um=3&ct=result

CSR
January 9th, 2009, 12:39 PM
Cider

Um guys, can we please have the guide back here? I dont use Cisco here but would like to read it.

Would be appreciated.

Thanks
January 23rd, 2009, 12:25 AM
Code.C6

No backups eh?
January 23rd, 2009, 04:23 AM
Cheap Scotch Ron

Cider, what do you use? If we cant get the doc restored, let's rebuild...
January 25th, 2009, 11:53 AM
nihil

Quote:

No backups eh?

that is irrelevant, the issue is with the vBulletin software, and the fact that the version we were using was heavily bastardised. Even though it was backed up, the backups are useless.

The links (references) to attachments, other threads, and polls changed with the new system and no longer work for old posts.

Furthermore, the size limit for attachments is now much smaller so it wouldn't have worked anyway.

I agree with CSR that it is time to start over............the post is 4 years old.
October 23rd, 2009, 07:01 PM
ByTeWrangler

1 Attachment(s)

Backup's help ;)
May 9th, 2016, 07:20 AM
majumdarc

I cannot see the file. Can anyone help me to get a link to download . I am basically looking help/ a consolidated file for hardening checklist
May 9th, 2016, 02:01 PM
Shay

File was lost in a upgrade. Been several since the October 23rd, 2009, post.