Interface or Trunk mode traffic - Internal traffic UMT features.

[NeoSeer]

Hello,

           I am debating if I should route all my internal network traffic through the firewall or have a switch in between firewall and internal clients.

Can we disable all UTM features(AV scan etc) for internal network traffic?

[Andre_Machado_da_Sil]

You can use both topologies. Use the firewall to route and secure the internal traffic is the dream of each network security professional. However you will must have a large box to deal with speed of the internal communication. The firewall in general are sized to deal with Internet speed that are way lower than internal speeds.

[cid:image002.png@01D27BE5.48C82850] http://www.amsinetworks.com

Andre Silva - andre@amsinetworks.com<mailto:andre@amsinetworks.com>
Direto: +55 (21) 3500 8100
RJ: +55 (21) 2223 6446 - SP: +55 (11) 2824 6114
S4B: andre@amsi.com.br<mailto:andre@amsi.com.br> – Skype: andre_ams
EUA/CAN: +1 (604) 500 2170
SIP/H323: 867322101@amsi.call.sl<mailto:867322101@amsi.call.sl>
[Click-to-Call me] https://portal.starleaf.com/webrtc?target=andre%40amsi.com.br




From: Neo Seer via Segmentation: [mailto:segmentation@lists.fusecommunity.fortinet.com]
Sent: August 1, 2017 5:41 AM
To: segmentation@lists.fusecommunity.fortinet.com
Subject: [Segmentation:] - Interface or Trunk mode traffic - Internal traffic UMT features.


Hello,

I am debating if I should route all my internal network traffic through the firewall or have a switch in between firewall and internal clients.

Can we disable all UTM features(AV scan etc) for internal network traffic?

-----End Original Message-----

[DrWolfgangBeneicke1]

Given that 99% of customer networks do not have any means of control of internal data streams even plain firewalling without any UTM would be a 100% increase in control, visibility and protection. The FGT is a reliable router as well so you might well shift routing and core distribution to a right-sized FGT.

Instead of AV I would cautiously introduce IPS on internal traffic to block the most hazardous outbreaks. The internal botnet protection alone (IP blacklist) could save you a lot of trouble.

High performance FGTs have their price but a top-vendor backbone switch does as well. I often see top-notch bb switches from HP, Extreme, Juniper,..., which cost a lot because their feature set is enormous - and only used to 5% in that environment. Switches often lack visibility, analysis of traffic types, traffic shaping etc. etc. which you will get for free in FortiOS.

So, yes, if the CEO is willing to invest in internal security and outbreak control, a segmentation FGT is a good move.

Just my .02$

- ede_pfau