With the addition of the Assets monitoring panel in RAForce, the IntelliShun can now report on internal IP addresses for outbound blocks when deployed on the trusted (LAN) side of the firewall. This is a significant change to how IntelliShun can be used, but provides improved response capabilities to those wishing to be more proactive in their security stance.
WAN Deployment
Traditionally, RiskAnalytics has recommended the IntelliShun be installed at the network perimeter, on the untrusted (WAN) side of the firewall or edge router. This configuration offers a number of advantages:
Reduced workload on the perimeter firewall
Blocked attackers and regions can’t access services exposed or port-mapped by the firewall, such as VPN or management functions
RAForce can report on all inbound attacks
Traditional WAN deployment has one disadvantage:
Outbound blocks from private network segments will be attributed to the egress IP address -- usually the firewall or router’s public IP -- instead of the IP address of the internal asset in question.
WAN Deployment Diagram
LAN Deployment
Benefits to deploying IntelliShun to the trusted side of the firewall include:
Visibility of the true internal source of outbound blocked traffic
Inbound blocks represent attacks that the firewall did not stop
Disadvantages to internal LAN deployments:
Decreased router/firewall performance under higher workload
Potential exposure of services on the perimeter router/firewall
Loss or degraded reporting of external inbound attacks
LAN Deployment Diagram
Tandem Deployment
It is possible to deploy a pair of IntelliShuns -- one on either side of the firewall or router -- to gain the advantages of both deployment methods:
Reduced workload on the perimeter firewall
Blocked attackers and regions can’t access services exposed or port-mapped by the firewall, such as VPN or management functions
RAForce can report on all inbound attacks
Visibility of the true internal source of outbound blocked traffic
Disadvantages of tandem deployments:
- Higher total cost of service, though discounts are available for tandem deployments. Contact sales@riskanalytics.com for a quote.
- Slightly increased perimeter network complexity