SQL slammer - Why it's a good idea for access-lists on your INSIDE int

[tbissett]

There have been a lot of great tips from this forum, so I figured I would offer this as well:

Saturday's SQL slammer worm is a perfect example of why everyone should ignore Cisco's default "allow everything out" policy and apply an access-list to your INSIDE interface.

Not only would this conform better to firewall best practices (that which is not expressly permitted is denied), but also helps to impede the propagation of worms like this.

You might be very surprised at just how much traffic is trying to go from the inside out. We have always had access-lists on our inside interfaces of our PIXES. We have caught a number of trojans, spyware, and other unwanted goodies just by watching the logs for what gets denied trying to leave our firewalls.

OK. I'm off my soap box now

 

[baddos]

I would strongly aggree. The fact that Cisco doesn't even mention it in the PIX manual also disturbs me.

 

[vexxed]

Damn straight, I agree. I have always done this as well; you never know what kinds of trojans and viruses poeple are bringing into the office.

 

[jacare]

Totally agree. What ports do you guys restrict ?

 

[baddos]

I only allow the following:

For all computers
80/tcp
110/tcp
443/tcp

For my email servers I allow

25/tcp

For my DNS servers
53/udp
53/tcp

 

[ianbla]

How does your access-list look?

How do you deny everything else?

cheers
Ian.

 

[baddos]

access-list 101 permit tcp any any eq ftp
access-list 101 permit tcp any any eq ftp-data
!Only needed if you want to FTP
access-list 101 permit tcp any any eq domain
access-list 101 permit udp any any eq domain
!Can restrict this to only your internal DNS for better security
access-list 101 permit tcp any any eq www
access-list 101 permit tcp any any eq pop3
access-list 101 permit udp any any eq ntp
!Clients can synchronize their clock w/ time servers
access-list 101 permit tcp any any eq https
access-list 101 permit tcp host xxx.xxx.xxx.xxx any eq smtp
!xxx.xxx.xxx.xxx is my email server
access-list 101 deny ip any any
access-group 101 in interface inside