Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 12 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 9730 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Do I need a Dmz

PeterWeir

Hi

We have a Utm and at the moment we do not have or need a Dmz

We have just bought a pulse secure appliance that has two network ports internal and external.

I’m trying to decide the best way to set it up. If I create a new interface with a new IP address range and plug the wan connection from the pulse box not that. I can then nat an IP address to that box. I can block all the ports that I don’t need. If I then put the lan cable from the pulse secure box into our core switch the pulse secure box will have access to all internal systems.

However, I’m not sure what benefit this gives me over just setting up NAT straight to the pulse secure box that’s on the lan.

Can anyone think of a better way to do it?



This thread was automatically locked due to age.
Parents
  • 0

    I must say that your description is very cryptic to me, please add a picture for more clarity on what you want to connect where (in relation to your internet connection and the UTM).

    I'm not sure what a pulse appliance does, but if you need to connect it on the inside of the UTM and it needs to be accessible from outside, then a DMZ is a good solution.

    By creating a DMZ and also make sure you have appropriate firewall rules (only allowing the necessary traffic from DMZ to LAN and vice versa) you have the best level of security should the pulse appliance be breached.

    This is of course true for every other device or service that is accessible from the internet.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    Apologies for not being clear.

     

    The Pulse Secure box ia  VPN and NAC server. It allows you to access internal resources via a webbased proxy.

    I actiually found this artical. It would suggest that a 2 arm 2 dmz would be the best but not sure how I would set this up on the UTM. We currently do not have a DMZ setup.

     

     

    kb.pulsesecure.net/pkb_mobile

  • 0 in reply to PeterWeir

    That would be possible by creating 2 "dmz" interfaces. Since both interfaces of the Pulse device are connected to the firewall, you need 2 additional interfaces (so at least 4 in total, 1 external, 1 LAN, 2 dmz for pulse)

    You can name those ie. Pulse-external and Pulse-internal or something like it.

    Then you can create firewall rules and or DNAT with auto-firewall rules enabled that enable the needed ports from the internet to the external port of Pulse device.

    And you can create firewall rules for traffic that should be allowed from Pulse internal to LAN.

    PS: You could also just use the UTM as your VPN access point (if you have the right license that is), that way you might be able to completely omit the Pulse device.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    So would I create two new interfaces on the UTM. say a 192.168.0.0 for pulse-external and 192.169.0.0 for pulse-internal

    In the Additional interfaces assign an IP at pulse external interface.

    Would I then not need to create the DNAT jsuta a firewall rule for inbound onto the Pulse box

     

  • 0 in reply to PeterWeir

    192.168.0.0 is okay (if not already in use somewhere).

    192.169.0.0 is not advisable since it's not RFC1918 and is most likely in use somewhere on the internet (see https://en.wikipedia.org/wiki/Private_network).

    In stead of using anything from the 192.168.0.0/16 range it might be better to use something from the 172.16.0.0/12 range since these are less likely to give (future) problems with other locations that are using a "standard" addressing scheme.

     

    For all traffic coming from the internet and going to your pulse external connection you will need a DNAT rule for traffic from Internet (or any), going to External (Address) change destination to IP-address of Pulse-external interface. In the DNAT you can tick the option for Auto-firewall rule.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to PeterWeir

    Peter, as apijnappels said, the UTM can do all of the things the pulse can do.  The limitation with the UTM's HTML5 remote access method is that it is very resource-intensive and I wouldn't recommend it if you expect to have more than two users on it simultaneously.  My preferred solution would be the free SSL VPN client with SSL VPN remote access.  That will allow you all of the same access control you can have with the Pulse.  If you want strict security, you can add one-time passwords for two-factor authentication.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    To be honest the pulse box has been bought by a previous employee.

    How do you do 2fa on the utm vpn.

Reply Children
  • 0 in reply to PeterWeir

    2FA can be set up under Definitions & Users => Authentication services => One Time passwords.

    It uses TOTP (just like Google Authenticator and authy, but also has it's own Sophos authenticator app that can be used).

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Unfiltered HTML