Forum Discussion
Michaelyang
Cirrostratus
CirrostratusIf there is no firewall, the risk of problems
Hello, My architecture is as follows " Clients -> firewall -> F5 -> Server " I would like to ask if it is risky to open all ports in the client->F5 VIP section of the firewall? For example. 445 ...
Michaelyang because the F5 is not configured to listen on 445 in the example you have provided you do not have a risk currently for the backend servers or the F5. The keyword here is currently, it is possible that in the future a vulnerability might exist that does leave your F5 or backend servers vulnerable to an attack and why you should only ever allow the ports you need through and not everything. What is the reasoning for allowing all ports through to the F5 virtual server? If the reasoning here is because someone doesn't want to go allow each port when you start to use it that is an extremely flawed and a huge security risk approach to managing a network. It's best to stick to best practices and not to encourage practices that put your network in a vulnerable security posture.
Hi Michaelyang ,
As long as you do not configure a Virtual server or a listner to listen for port 445 , F5 will reject all of these traffic destinated to this port , so that no further traffic should reach to Back end server because F5 will drop all of traffic require this port.
I am only curious about , do you perform a destination NAT on your firewall ? or not ?
Also the best practise to be in the safe side is to harden and restrict your Firewall policies , you should filter layer 4 connections by a firewall first , to prevent non beneficial traffic to reach to F5 , This my opinion.