DDOS / DOS Protection

[ThamiDlaminiITN]

Is there any benefit of placing an additional firewall on the OUTSIDE of the customer's internet/external router? There is already a perimeter firewall on the inside of this router.

(Proposed additional firewall running virtual wire) <---> External Router (BGP and internet links) <----> Perimeter Firewall <----> Internal Router

This external router is serving as the internet gateway for the FW as well as a BGP termination point for various of their external links. The firewall does not take part in the BGP. ALL traffic from that internet router then passes through a perimeter gateway firewall and then gets sent to wherever it needs to go to in the inside of the customer network (they have an internal router also).

The network team wants us to put an additional PA firewall on the OUTSIDE of the internet router to provide protection for that router against DOS and other attacks. Note that inspection and security policies are already done on the firewall on the inside of the router to protect the internal resources.

Will the PA be able to provide enough protection to make this worth while? I assume this will only for network layer attacks so only really what is available in a DOS protection profile or will vulnerability protection also help here? Or should they get a dedicated DDOS appliance for this?

I've never had to firewall/protect the actual network infrastructure before so no idea what to tell them here.

[SCantwell_IM · Accepted solution]

Good Day

It is possible to put a FW in front of the Internet Router, but the appliance would need to be scoped bigger to handle massive potential payloads that are unwarranted (DoS).

If given the choice, I would work with the ISP to help limit DoS attacks coming to the router, as more ISP hardware  typically has better hardware buffer capacities to ward on a DDoS, built into their hardware.   

You may want to do some SNMP queries to determine that number of connection per sec (cps) that the router is handling at different times/peak times, to determine what PANW FW (if you choose to utilize it) for your customer.

What other questions can we answer for you?

[TomYoung]

Hi @ThamiDlaminiITN ,

I have seen some sales people promote protecting the external routers, but I agree with @SCantwell_IM .  Most routers are built to be connected to the Internet and can be patched, hardened, and configured with some features to limit DoS.  Most ISPs offer some DDoS protection, and some offer extra DDoS protection as an additional service.  I would work with the ISP 1st.

Thanks,

Tom

[ThamiDlaminiITN]

Thank you for the responses guys, really appreciate it. They helped.