Source
r/networking•
qnull

How to govern/audit vendor managed firewalls?

This can’t be a problem unique to my org, but our firewalls are managed by a vendor.

We send them the firewall requests and they implement the rules, but we’ve noticed that sometimes what’s asked is not what we get.

We also have no way to manage firewall rules that are no longer required. For example, if a service is decommissioned it’s up to that project/owner to submit the firewall requests to internal ICT to review and send to the vendor, but this almost never happens.

A third concern is our dev environments, because while we still audit and approve the rules, an uncomfortable percentage of them are “this is dev and we aren’t sure which of this 30 rules we actually need”

I know auditing our rules is going to be a PITA job but it must be done so I’m wondering if there any solid methodologies/practices I should be looking at.

Perhaps there is a rule visualisation tool that might help identify what is going where?

Posted Dec 10, 2020, 11:05 PM UTC

57
packet_whisperer•

Do you have access to the firewall to review the rules? I've easy thing to look for is any rules with zero hits. Then look for any loose policies, like permitting all ports or any host. Post that you need to dig in more to figure out what's actually needed.

There are tools to do the analysis for you such as AlgoSec and Firemon.

4
jnuts74•

+1 for Firemon.

You’ll find errors, policy fuck ups, risk reports and changes outside of change windows and SLA chaos to the point of billing back your MSP if you implement Firemon correctly.

3
RadagastVeck•

Am I looking at the correct place that firemon cost starts at 60k? I was interested but damn that price was a surprise (not saying it is not worth it)

2
jnuts74•

It depends. I think they license by number of firewall clusters.

What city are you in? (You can DM me that if you don’t feel comfortable putting that here)

I ask because prices on tech do sway across regions and depending on the partner you purchase through as well.

2
vsandrei•

Am I looking at the correct place that firemon cost starts at 60k? I was interested but damn that price was a surprise (not saying it is not worth it)

Think about it this way. The alternative is to manually audit the firewalls, requiring another FTE . . . which will easily cost your management north of $60K if the FTE is actually competent at the work. Oh, and the work will still be manual and error-prone.

1
HoaTapu•

It seems like there isn't a clear firewall change management in place. Maybe you might want to assess their process and check if they're implementing rules based on the sop.

One thing I noticed in alot firewall deployment is the rule management. There is lack of proper organising of rules. Insufficient information on the rule itself e.g. ticket number to trace and rule ownership. All these makes managing the ruleset very difficulty and sometimes this may lead to security issues.

You need to ensure the vendor has a proper change management including regularly review of the policy rules e.g. quarterly. This should be provided by your vendor and given to you to review. You should also have access to the firewall management console/dashboard to verify.

Regarding the tools, your vendor should be the expert and recommending the solution.

Another point is the next-gen firewalls usually comes with add-onfeature or modules that have compliance check. You may want to take a look. Usually this is much cheaper than a 3rd party commerical product which comes with way too many features.

2
dorkmatt•

Would suggest Oxidized or Rancid to pull the running configs, and email diffs out (generally versions are stored in a VCS, such as Git too). You would need an account on the devices with enough privileges to view (read-only) the running configuration.

1