What's the added value of an internal firewall in a company ?

[Jack_wack]

For external security we have an edge fortigate firewall with sophisticated of policies in place, such as:

AV, WAP, ATP, IPS, SpamFilter, Content Filtering, and much more.

For internal security we have a lot of layers of defense in place, such as:

FortiNAC, sophisticated Windows Domain policies, and L3 switch segmentation.

What is the added value of adding an internal firewall into the LAN in my situation?

Are there any other threats that cannot be addressed and mitigated by the mentioned solutions ?

[gfleming]

With an internal firewall you can do micro-segmentation, you can scan east-west traffic and block lateral movement of an attacker, you can gain valuable insights and visibility into what network traffic exists inside your network not just what is leaving or coming into your network.

It can also be easier to manage VLANs, routing, etc on a FortiGate vs other devices.

Lots of reasons... i Could go on! :)

[ede_pfau]

IMHO the main difference to your current switch-based segmentation of your LAN into VLANs vs. firewall based segmentation is that with the latter you can enforce policies. This is not comparable to ACL on switches which are less effective (i.e. not stateful), intransparent and hard to maintain.

As modern firewalls can recognize the type of traffic or service, you can additionally "micro-segment", that is, not only split your LAN into several VLANs to guard against the unlimited spreading of malware, but limit access to server groups or even single servers (mailserver) to a specific service. All of this to narrow down the size of the attack surface on the internal LAN.

A perimeter firewall will not help if malware is brought in via BYODs. Apart from protecting assets a Fortigate can well be used to monitor and detect malware on the LAN.

So, yes, two tier firewalling is recommended, if not even current best practice.

[Jack_wack]

Well, I can have the current fortigate doing the vlans routing and segmentation. i.e. taking over the job of the L3 switch. And of course, I'd apply all those fine security policies at service/application level.

That would inhance the other LAN layers of defense, i.e. the fortiNAC and Windows Domain policies.

And would limit the chances of unauthorized access and insider threats.

So, If I put the main firewall in the center of my network, and have all the branches passing through it, I think then we're all fine without a second firewall. 

[gfleming]

Yes a Fortigate can absolutely be an edge and an internal firewall at the same time. But often times it doesn't make sense to consolidate in this manner. You likely don't need Web Filtering or other NGFW on the internal firewall. But if you need 10Gbps of throughput internally you're spending a lot of money on your edge firewall doing Web Filtering etc.

Also having everything in one place creates a large failure domain. If you separate duties you can have different features and different code running on each device to minimize exposure to vulnerabilities and bugs, etc.

[Jack_wack · Accepted solution]

SPOF is prevented by High Availibility HA.. so no worries about that.

The central fortigate would treat traffic differently depending on the incoming and outgoning interfaces.

For example, there is WF in place for Outside1-Inside1 traffic, but no WF for Inside1-Inside2 traffice, or Inside1-WAN1 traffic (remote branched are connected to the HQ through wan connections)

So, most of the applied policies do make sense.

I thought there are other security reasons for using ext/int firewalls I'm not aware of.

That the internal firewall could catch LAN threats or malicious behaviors, the external firewall couldn't.

[gfleming]

SPOF is not wholly mitigated by just deploying HA. HA provided hardware redundancy. There are a whole host of other things that could cause downtime even with HA enabled. So just be careful there.

There is no difference in ability between an external or internal FW. It's more to do with how much performance you need on one vs the other and what kind of feature licenses you require on one vs the other. 

You can do it all on one device or separate it out. The functionality of an internal firewall is the same. You just need to understand the limitations of putting it all on one device.