Single Rulebase for Multiple Firewalls?

[roadrunner]

Single Rulebase for Multiple Firewalls?
Having one rulebase for all your firewall versus a single rulebase have their plusses and minuses.

If each firewall has a different rulebase file, it is fairly easy to see what security policy is on an individual firewall. Also, it is far easier to specify whether or not a rule is enforced inbound, outbound, or eitherbound. On the other hand, it is possible to install the wrong rulebase on the wrong firewall, thus causing an outage on an individual firewall. Also, if you have to make global changes, you have to change each individual security policy file.

A single rulebase is slightly more difficult to maintain. On the other hand, you can see your entire site's security policy at a glance and it does prevent snafus that occur from installing the wrong rulebase on the wrong firewall. Only the rules that apply to a specific gateway will be installed there. On the downside, when you list specific gateways in the Install-On field, rules are enforced in the eitherbound direction (i.e. they must pass through the rulebase twice). This is only usually noticable with large rulebases on heavily-loaded systems.

If you are going to go with a single security policy file for multiple firewalls, here are my hints:


Rules that apply to "all" firewalls should have the install-on be listed as gateways (e.g. any any any drop)
Potentially busy rules on all firewalls should be installed on gateways to increase performance (even if a particular firewall can't enforce the rule).
-- PhoneBoy - 11 Jan 2004


FAQForm
FAQs.Class: MiscellaneousFAQs
FAQs.OS:
FAQs.Version: