Internal Network Firewalls (INFW) - Secure your LAN & WAN

What is an Internal Network Firewall?

Why use a Internal Network Firewall (INFW)?

The most common location for a firewall is at the network-edge or perimeter. Perimeter firewalls deployed in this manner are designed to secure traffic to and from the internet (i.e. north-to-south traffic). However, while these perimeter devices may identify external threats passing through your perimeter firewalls, their positioning in the network means they are unable to identify or block viruses, hackers and similar threats moving laterally throughout your network (i.e. East-to-West). This lateral traffic could be data flows between your departmental networks, between your dev and live environments, or across your WAN from other offices.

This is where the internal network firewall has a key role. The Internal Network Firewall (INFW) securely segments your network whilst simultaneously screening for unusual traffic, indications of compromise and other anomalous behaviour.

Internal Network Firewalls (INFW) are also described as Internal Segmentation Firewalls (ISFW).

External vs Internal Traffic

In most IT or hosted environments, the traffic patterns can broadly be described as:

  • North to South – Traffic going from the LAN to the Interent, and vice-versa.
  • East to West – Traffic internal to the organisation, routing server-to-server, server-to-client or client-to-client but not leaving the organisation. This can be between IP subnets or routed VLAN interfaces (typical in many enterprises with L3 switches).

The exact ratio of north to south and east to west will vary from business to business and it will depend on the exact IT environment. Figures from Gartner suggest 77% of traffic is East to West, whilst 17% is North to South (The remaining 6% is between sites). Those figures represent a significant amount of traffic that is not regularly screened against an intrusion prevention system and other related security checks.

Internal Network Firewall – Use Cases

If you business is looking to enhance its internal network security, there are a number of key use-cases or scenarios where the internal network firewall is a great fit.

  • Department or functional separation. The INFW can be placed to provide secure segmentation between functional departments (i.e. Accounts, IT, R&D). MTG can work with you to identify typical inter-departmental traffic flows before implementing a baseline policy to secure intra-organisation traffic.
  • WAN Security. In many organisations the WAN component, linking other offices or suppliers, is treated as an internal network and therefore is not subject to the same perimeter security checks. In a large organisation, a malware outbreak can propagate across the WAN or provide a method for attackers to infiltrate other sites. The INFW can implement a network security policy on your WAN links.
  • Supplier Extranets. It is common for links to suppliers to pass through the perimeter security however in many cases this is not feasible. An INFW firewall can be deployed to provide a secure gateway between your business and your suppliers.
  • Defending key network assets. In many businesses there may be a particular department or network segment that holds particularly sensitive of valuable data assets. In these scenarios, the INFW should be considered to further protect these network assets with the added functionality of an Intrusion Prevention System (IPS) and advanced firewalling features.

How to deploy an INFW?

There are generally three methods to deploy an internal network firewall:

  • VLAN Separation. For organisations using VLANs, they may use L3 VLAN interfaces or inter-vlan routing to enable traffic flows between L2 Ethernet networks. The INFW can be added to the existing Ethernet environment as a high speed trunk interface, managing the routing between L2 VLANs. The Ethernet switch then reverts to being a L2 switch.
  • Interface Separation. In this scenario, individual Ethernet ports of the firewall are patched into the various switches or VLAN access ports.
  • Transparent Mode. In transparent mode, the INFW serves as a transparent L2 bridge, invisible to the network. Bridge mode is useful when you want to protect or monitor a discreet network segment.

In all cases, MTG has worked in a variety of network environments and recommend the most appropriate solution based on your security needs.

Monitoring Features

The INFW firewalls have the same rich feature-set that our managed firewalls have. Internal Network Firewalls can also be managed 24x7x365 by our security operations team.

Related Services

Firewall Management Service
Managed Firewalls


More Information

Get in touch

  • SALES:  01624 640400
  • SUPPORT:  01624 639420

Fortinet Threat Map: provides real-time visibility of cyber attacks. View in full screen.

High Performance
The devices are capable of routing traffic at multiple Gigabits (Gbps), with a range of interface options available including 1Gbps, 10Gbps, fibre and copper.
Threat Detection
Our firewall analysis and SIEM systems are able to pro-active identify threats, anomalies and malware signatures – that may indicate some form of security event within your business.
WAN Security
Secure your WAN environment, protecting your offices from threats and vulnerabilities that may spread propagate across your WAN.

Find out more about our managed firewalls …