Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 32 replies
  • Answers 4 answers
  • Subscribers 10 subscribers
  • Views 48076 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Runing Sophos UTM virtualized or on dedicated hardware?

widdde

Hi!
I have a computer with a Core I7 2600K, 32GB ram, 4 Intel nics, and I'm planning to run Sophos UTM on this as my primary firewall (home use with some internal and some public servers behind).

I think it is quite a waste to use the hardware as a firewall only, I don't think Sophos need an I7 with 32GB ram, or am I wrong?

I have a little thought to run ESXI on the machine to have some more vm:s running on it in parallell with Sophos UTM.

I think the hardware can handle a one or two vm:s alongside a Sophos install..?

 

My biggest concern are the security, how secure is it to run the firewall virtualized? For some reason my heart screams a little when I'm thinking to run it virtualized, because
a dedicated approach should be more secure, because you don't expose a virtualization platform to the net as you do with a virtualized approach.

But is it common that hackers find holes on the virtualization platform and can gain access to the internal lans? How safe are virtualization platforms nowadays?

I don't think it is an uncommon approach on companies to run it virtualized, but maybe I'm wrong. This is for personal use in a home environment, but I still want secure networks.

I may run it virtualized if you say that it is safe.. :P

 

For your information: I have a 250/100Mbps fiber connection to my house.

 

Thanks in advance!



This thread was automatically locked due to age.
  • 0 in reply to twister5800

    Thanks for your response!

     

    My server has 4 physical Intel NICS. One of them will be used only by the Sophos UTM. (And regarding the CPU I will only run one or two small VM:s on the server
    and Sophos UTM of course)
    Unfortuneately I can't pass through the network card to the Sophos VM, because my Core I7 2600k does not have Vt/d (the k model does not have this)

    Will this be an issue?

  • 0 in reply to widdde

    widdde said:

    Thanks for your response!

     

    My server has 4 physical Intel NICS. One of them will be used only by the Sophos UTM.
    Unfortuneately I can't pass through the network card to the Sophos VM, because my Core I7 2600k does not have Vt/d (the k model does not have this)

    Will this be an issue?

     

    Absolutely not, just create a new vSwitch in VMWARE and add the physical nic to it, after that, create a new nic in the SOPHOS VM thats assignes to the new vswitch port group :-)

    VMDirectPath is only needed in specialt setups ex. graphics VDI aso.

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Technician

  • 0 in reply to twister5800

    Thank you!
    Will try this in my labbox first! :)

  • 0 in reply to widdde

    widdde said:

    Okey, thanks for your response.
    I know that every device in the network and devices that is carried out of the network can be potential dangerous, but somewhere we have to draw a line. This is my home network and I can't be that paranoid with phones carried in and out of the network and so on.

    But I understand your point to not virtualize Sophos and it was this answer I was looking for. I think I will run UTM on dedicated hardware. Right now it is running on a box with a J1900 celeron (I think it is 2Ghz per core) and 8 GB ram. As I have understood IPS can run multiple instances of snort and when I do a benchmark test of my speed I can't get more than 150Mbps on that particular connection, but when surfing on other sites while doing a test I can get more bandwidth because another core will take care of that connection. Am i right?

    It felt wrong to virtualize the firewall, but I wanted more information regarding this issue and exactly how insecure it is to expose the hypervisor. 

    I have 2 servers running ESXI and both of them are behind my dedicated UTM today, and I think I will keep it that way. Maybe I use my Core I7 with yet another ESXI install and run some vm:s on it and keep my J1900 celeron box to continue to run Sophos on it (dedicated)

     

     
    Widde,
     
    The throughput test results and limits vary depending on many factors.  When using the macOS Speedtest app from Ookla, I get 100Mbps if FTP scanning, IPS, and other options are on.  With certain settings off, the test shows my full 350Mbps bandwidth.  Regardless of these settings on or off, I get the full 350Mbps results if I use the Ookla website http://beta.speedtest.net to test. That's because the only Traffic Shaping I have on Web Scanning is VOIP priority.
     
    I agree that having the UTM at the head of your network in Gateway mode is best.  This is not just for security reasons. This is because it allows you to use the UTM for what it is built for.  If the UTM was internal with nothing at your "head", I would deploy something extra to protect the Host Server, its OS, and the Hypervisor; like Sophos Server Protection or VMWARE NSX.  That would protect everything on the server as well as flowing through it.  This would also protect the UTM and eliminate many of the self-protection features you have activated in your virtual UTM - allowing your UTM to run super lean and focus on protecting what is down the internal network instead of protecting the individual VM it is in.
     
    As far as virtualization vs physical, all I'm saying is that a virtual deployment of the UTM isn't going to protect everything.  Depending on the specific issues and threats you identify, this setup may or may not be a good idea.  A virtual UTM will protect the communication and devices on network connected to it.  The virtual UTM can't protect the physical host it is in nor the hypervisor managing it's virtual state.  It also can't protect the physical NICs, USB, bluetooth, Wi-Fi, or other ports/networks on the server, whether it uses them or not.
     
    In other words:
    1. Is the UTM and it's assigned network safe?  Sure.  It's safer than not having the virtual UTM inline.  There are still so many ways malware can creep in through memory, hypervisor, physical host ports, KVM, and remote/virtual desktops connections.
     
    2. Is the host server and its virtualization environment safe?  What about the other networks/devices not connected through the virtual UTM?  NOPE, not unless you have something else covering those.  In reality, you do to a certain degree.  Most vendors require or recommend you run on Intel chips. A big reason is so that the built-in McAfee security system can hopefully catch and stop certain malware before it corrupts key processes, but this is not an all inclusive protection system to be relied upon by itself.
     
    DarrellR claims that VMWare attacks are rare.  If that is so, why is WMWare, Sophos, Symantec, Palo Alto, and so many major security vendors in a rush to ensure they have virtualization covered?  Well, it's because virtualization is the easiest and fastest way to deploy malware, specifically ransomware.  It's so easy to do.  Any Keyboard/Mouse/Video or connection can allow malware to inject into your VMWare because it connects to the VM holding the UTM, not to the UTM.  Any USB, network, or optical drive connection can also provide the same problems in the same ways.  All these vector I mentions can be in one single virtual desktop client.  Your shared resources of CPU, RAM, and storage systems NAS/SAN can also be a vector for injection.  The list goes on and on.
     
     
  • 0 in reply to David Birdsall

    David Birdsall said:
    DarrellR claims that VMWare attacks are rare.  If that is so, why is WMWare, Sophos, Symantec, Palo Alto, and so many major security vendors in a rush to ensure they have virtualization covered?  Well, it's because virtualization is the easiest and fastest way to deploy malware, specifically ransomware.  It's so easy to do.  Any Keyboard/Mouse/Video or connection can allow malware to inject into your VMWare because it connects to the VM holding the UTM, not to the UTM.  Any USB, network, or optical drive connection can also provide the same problems in the same ways.  All these vector I mentions can be in one single virtual desktop client.  Your shared resources of CPU, RAM, and storage systems NAS/SAN can also be a vector for injection.  The list goes on and on.
     

     

    Virtualization is covered because it sells agents.  FUD sells agents.  Do you have any evidence that virtualization escapes are NOT rare?  What the hell does virtualization have to do with malware/ransomware spreading?  Where are you seeing this as an attack vector?  The MOST likely method of infection will be phishing or drive-bys on websites.  Some consumer gateways have vulnerabilities that leads to c2 infections.  But vm escapes or attacks on the hypervisor from a guest machine just don't happen.  Imagine the fallout if those were common.  Hosting companies would be shutting down en mass.   VMware would be out of business.  Amazon would have to shut down AWS.  Seriously.  This is FUD, pure and simple (at least until it is not).  For a home user, dedicating all that hardware to a UTM is a waste of resources.  They are far more likely to visit a shady p0rn site or get hit with malvertising or have an asteroid fall on their house than they are to be compromised by a vm escape attack these days.

    Again, what you are recommending is solid for large business, but SMB and definitely home, this is good enough.

  • 0 in reply to darrellr

    The only thing im worried about is attacks from the outside, from the net. This because the hypervisor is physically connected to the net instead of the utm.

    I want a really secure lan, thats why im asking and i can of course run a separate box for utm but as said, feels like a waste.. But the security is prio one (from the net, not from lan side)

  • 0 in reply to widdde

    As stated, many of us run this way without issue.  Like David said, it ultimately comes down to your comfort level, but I really doubt you are harboring the droids they are looking for in your home network.

  • 0 in reply to darrellr

    darrellr said:

    Virtualization is covered because it sells agents.  FUD sells agents.  Do you have any evidence that virtualization escapes are NOT rare?  What the hell does virtualization have to do with malware/ransomware spreading?  Where are you seeing this as an attack vector?  The MOST likely method of infection will be phishing or drive-bys on websites.  Some consumer gateways have vulnerabilities that leads to c2 infections.  But vm escapes or attacks on the hypervisor from a guest machine just don't happen.  Imagine the fallout if those were common.  Hosting companies would be shutting down en mass.   VMware would be out of business.  Amazon would have to shut down AWS.  Seriously.  This is FUD, pure and simple (at least until it is not).  For a home user, dedicating all that hardware to a UTM is a waste of resources.  They are far more likely to visit a shady p0rn site or get hit with malvertising or have an asteroid fall on their house than they are to be compromised by a vm escape attack these days.

    Again, what you are recommending is solid for large business, but SMB and definitely home, this is good enough.

    Darrel,

    You're describing the exact opposite threat of what Im describing.  Im taking about injections from peripheral device to physical host to host OS to hypervisor to VM.  Im not talking about "virtualization escape" attacks in the opposite direction.  The attack Im describing is more common in home environments than in larger settings because large organizations protect their servers directly from both physical access as well as remote access.

    In your recommended setup, you're only covering a couple of network ports.  You're not covering any other port on the server.  This leaves the host server unprotected, as a whole.  The home user is much more likely to plug something into another port on the server and infect the host.  The host OS, hypervisor, vSphere, vSwitch, and other virtualization organization programs are not virtualized.  They are standard software running in the host OS.  Once the host OS or virtualization control is infected, the VMs are easy prey.  But really... all the malware would need to do in your setup is to shut down your two physical ports or shut down your hypervisor or shut down the server or encrypt it.  The malware would not need to "escape" any virtualization, and your virtualized firewall can't see it nor do anything about it.

    In most virtualization today, the ports between clients and VMs are encrypted.  Your email, banking, social networking, text messaging, and many other common home communications are also encrypted between the internet and home network device.  If your virtual UTM is not scanning encryption connections, your VMs and home network are still at risk of infection.  Yes, the UTM will scan the header information of encrypted packets coming through it, but it's probably not going to flag packets coming from within the network.  How many home users are going to take the time to deal with the necessary settings and certificates to enable encrypted scanning on web, email, and other protocols?  all it would take is a home to get infected from a bad link in an email or social network post.  Then, that device can infect one or more of your VMs as well as other devices on the network.  Now, the home virtualization user has to either go and rebuild that VM form a snapshot they believe is clean or deploy another product to protect their VMs.  The home user must also deploy another product to clean and protect the devices they can access.

    Data centers get hit all the time.  The reason why you don't feel it happening to you is because good data centers and virtualization designers deploy redundancy to immediately replace the current infected/corrupted VM with a clean copy running in parallel or active standby, instead of taking the time to clean the infection/corruption.  Home virtualization users don't commonly employ this simple protection.

    So yes, of course, I agree that a home user deploying the hardware, software, and licensing to host a virtual UTM to protect their network is a waste.  It is simpler, cheaper, and more efficient to deploy a simple firewall appliance for under $500.

  • 0 in reply to David Birdsall

    I do not feel this thread is going to help the OP any more and we are simply more likely to confuse the issue.  You and I will not come to an agreement on this.  I will consider this conversation done.

  • 0 in reply to darrellr

    darrellr said:

    I do not feel this thread is going to help the OP any more and we are simply more likely to confuse the issue.  You and I will not come to an agreement on this.  I will consider this conversation done.

    Darrel,

    No, of course not.  We're not going to agree.   These recent replies of yours tell me that you're just trying create an argument and win it.  You're not trying to help make sure Widde or anyone else viewing this issue can learn about options and the pros/cons/issues associated with them.

    Widde understands the difference of running the UTM/Firewall in a physical firewall appliance vs virtualized.  Don't put him down or anyone else by confusing that fact with your argument.   Widde is asking to hear the advantages and disadvantages of both, so are some of the other people coming to view this issue.

    You're stuck on claiming a virus isn't going to escape the VM and get out while being protected by a virtualized UTM.  I'm trying to discuss this with you to understand how the virus got on the VM in the first place while being protected by your virtual UTM, but you're avoiding that explanation.  Is it because that explanation would negate your point of a virtual UTM?

    Im not here just to debate of how viruses got past your virtual UTM the first time but won't "escape" a second time in your design.  Im here discussing overall cost and maintenance over time.  Im discussing how complicated the setup and troubleshooting will be for both.  Im addressing how many products one would need in both setups.  Im also addressing what issues each stops will create or solve.

    I still stand by my recommendation, and Widde understands why:  For less than $500, Sophos SG UTM or XG Firewall can be deployed in Protecli 6-port Vault firewall appliance or something similar at the "head" of the network.  The internet gateway would be connected to the default WAN port, and the internal network on the default LAN port.  If you wanted to scan everything coming in and out of servers too, they can be placed on any of the other ports.  There would be no need to purchase or maintain software and licenses for virtualization as all of the security and virtualization software can be free: Sophos SG UTM, Sophos XG Firewall, Sophos Home, Oracle VM VirtualBox.

Unfiltered HTML