Forum Discussion
AltocumulusSame load balancer for all traffic
Hi,
As per suggested design, you will have a physical Load balancer for internal, DMZ and external VIPs. I have feedback in the security side. The single load balancer for all application leading into security risks(Increased Attack Surface) and A single point of failure for all zones. a feedback on this as
Ø Implement route domains(isolates network traffic) and partitions based on zones to logically separate routing between the zones(Logically separate the load balancer into 3).
Ø Lock down Self IPs using port lockdown(Never expose Self IPs directly to the internet/internal – for restrict management plan access)
Ø You have to use the security modules
o Use AFM (Advanced Firewall Manager) for zone-specific firewall rules. Enable DOS.
o Use ASM/WAF for protecting web applications, especially in DMZ/external services.
BR
Aswin
NacreousYou could possibly face lateral movement without any security control. Specially due to miss configuration.
You could separate Dmz and int VIPs to different route domains and partitions in the same BIGIP. Having both network and logical segmentation.
