Forum Discussion
Greg_130338
Nimbostratus
NimbostratusForwarding IP Question
I am going through some rules in our BigIP and I found one that is particularly disturbing (I think). We have an IP forwarding virtual server with both source and destination set to 0.0.0.0. This is allowing access to SSH, WebGUI, etc. through our public self IP address. I believe this was done to allow for management traffic to pass to servers that sit behind the IP which use it as their default gateway (ICMP, RDP, etc.) as well as facilitate the connection for those servers to access the Internet. There is no way this is best practice and I need to know the best way to remediate this asap. I think the desired configuration would be to configure a SNAT for the subnet that sits behind the BigIP, and then configure another VS that would enable management traffic to pass between internal subnets. I just need some clarification.
Thanks in advance.
What_Lies_Bene1Cirrostratus
You've a multitude of options. I don't see S/NAT as a security measure at all I'm afraid.
*Leave the VS as is and use a packet filter (or AFM) to restrict inbound access
*Leave the VS as is and use an iRule to restrict inbound access
*My preference: Leave the VS for the outbound access, disable it on the external VLAN. For inbound management create port specific VSs AND associated packet filters to restrict access.
*Better yet, use a secure access method (VPN, PPTP whatever) that doesn't go through the F5 and apply static routes as necessary on the servers.
nitassEmployee
Now my question is, if I change this, does this impact both ingress and egress traffic? If I change this to allow none, will that deny traffic inbound to this address but still maintain the ability to NAT from for these servers that route through the BigIP? Will it impact any of the other virtual servers that are connecting through this external interface?
port lockdown setting affects traffic destined to selfip (i.e. it does not affect virtual server and snat list traffic).
- Greg_130338Gotcha. So best practice for an external interface self-IP that is not inline with a firewall would be to create a custom list I would imagine? The Allow Default still allows https and ssh, allowing management of the BigIP from outside our network. Specific ports I should be looking to allow here?
nitass_89166Noctilucent
Now my question is, if I change this, does this impact both ingress and egress traffic? If I change this to allow none, will that deny traffic inbound to this address but still maintain the ability to NAT from for these servers that route through the BigIP? Will it impact any of the other virtual servers that are connecting through this external interface?
port lockdown setting affects traffic destined to selfip (i.e. it does not affect virtual server and snat list traffic).
- Greg_130338Gotcha. So best practice for an external interface self-IP that is not inline with a firewall would be to create a custom list I would imagine? The Allow Default still allows https and ssh, allowing management of the BigIP from outside our network. Specific ports I should be looking to allow here?
- nitass_89166
normally external selfip's port lockdown should be set to none.
administration should be done through management interface or internal selfip.
- Greg_13033810-4. Thanks all. I'm sure I'll have more hardening questions as I go through and fix a lot of this default config setup.
- nitass
normally external selfip's port lockdown should be set to none.
administration should be done through management interface or internal selfip.
- Greg_13033810-4. Thanks all. I'm sure I'll have more hardening questions as I go through and fix a lot of this default config setup.