Internal Network Security
The Internal Network Firewall (INFW) is specifically aimed at protecting your internal networks through a combination of network segmentation, data loss prevention and traffic inspection. Both SME and large enterprises should use INFW solutions are part of a wider network security strategy.
What is an Internal Network Firewall?
Why use a Internal Network Firewall (INFW)?
The most common location for a firewall is at the network-edge or perimeter. Perimeter firewalls deployed in this manner are designed to secure traffic to and from the internet (i.e. north-to-south traffic). However, while these perimeter devices may identify external threats passing through your perimeter firewalls, their positioning in the network means they are unable to identify or block viruses, hackers and similar threats moving laterally throughout your network (i.e. East-to-West). This lateral traffic could be data flows between your departmental networks, between your dev and live environments, or across your WAN from other offices.
This is where the internal network firewall has a key role. The Internal Network Firewall (INFW) securely segments your network whilst simultaneously screening for unusual traffic, indications of compromise and other anomalous behaviour.
Internal Network Firewalls (INFW) are also described as Internal Segmentation Firewalls (ISFW).
External vs Internal Traffic
In most IT or hosted environments, the traffic patterns can broadly be described as:
- North to South – Traffic going from the LAN to the Interent, and vice-versa.
- East to West – Traffic internal to the organisation, routing server-to-server, server-to-client or client-to-client but not leaving the organisation. This can be between IP subnets or routed VLAN interfaces (typical in many enterprises with L3 switches).
The exact ratio of north to south and east to west will vary from business to business and it will depend on the exact IT environment. Figures from Gartner suggest 77% of traffic is East to West, whilst 17% is North to South (The remaining 6% is between sites). Those figures represent a significant amount of traffic that is not regularly screened against an intrusion prevention system and other related security checks.
Internal Network Firewall – Use Cases
If you business is looking to enhance its internal network security, there are a number of key use-cases or scenarios where the internal network firewall is a great fit.
- Department or functional separation. The INFW can be placed to provide secure segmentation between functional departments (i.e. Accounts, IT, R&D). MTG can work with you to identify typical inter-departmental traffic flows before implementing a baseline policy to secure intra-organisation traffic.
- WAN Security. In many organisations the WAN component, linking other offices or suppliers, is treated as an internal network and therefore is not subject to the same perimeter security checks. In a large organisation, a malware outbreak can propagate across the WAN or provide a method for attackers to infiltrate other sites. The INFW can implement a network security policy on your WAN links.
- Supplier Extranets. It is common for links to suppliers to pass through the perimeter security however in many cases this is not feasible. An INFW firewall can be deployed to provide a secure gateway between your business and your suppliers.
- Defending key network assets. In many businesses there may be a particular department or network segment that holds particularly sensitive of valuable data assets. In these scenarios, the INFW should be considered to further protect these network assets with the added functionality of an Intrusion Prevention System (IPS) and advanced firewalling features.
How to deploy an INFW?
There are generally three methods to deploy an internal network firewall:
- VLAN Separation. For organisations using VLANs, they may use L3 VLAN interfaces or inter-vlan routing to enable traffic flows between L2 Ethernet networks. The INFW can be added to the existing Ethernet environment as a high speed trunk interface, managing the routing between L2 VLANs. The Ethernet switch then reverts to being a L2 switch.
- Interface Separation. In this scenario, individual Ethernet ports of the firewall are patched into the various switches or VLAN access ports.
- Transparent Mode. In transparent mode, the INFW serves as a transparent L2 bridge, invisible to the network. Bridge mode is useful when you want to protect or monitor a discreet network segment.
In all cases, MTG has worked in a variety of network environments and recommend the most appropriate solution based on your security needs.
The INFW firewalls have the same rich feature-set that our managed firewalls have. Internal Network Firewalls can also be managed 24x7x365 by our security operations team.