In this lesson,
we're going to discuss segmentation zones.
Using our firewalls, boundary devices,
and access control lists,
we can create segmentation zones
and we can set up rules based on these zones
so that all the inside rules apply to these interfaces
and all the outside rules apply
to those interfaces over there.
Now, when it comes to segmentation zones,
we're going to have three main zones that we talk about.
These are the trusted, untrusted and screened subnet zones.
Now, the first zone we have is what's known
as the trusted zone or the inside zone.
When you think about this, this is your local area network,
and it really is your intranet.
Anytime you're connecting
to your corporate local area network,
you're really talking about being inside
of this trusted zone.
And anytime you start talking about things outside of that,
you start going into the next zone,
which is called the untrusted or outside zone.
This is going to be things like the internet
or other networks that you may connect to.
Now there's a third zone that we have that's kind of trusted
and kind of untrusted,
and so we call this a screened subnet.
In the screened subnet, we're going to connect devices
that should have some restricted access from the untrusted
or outside zone, like our web servers and email servers,
but they still aren't necessarily trusted
by our internal networks either,
and so they're not part of our trusted zones.
This is kind of this in-between land,
between the trusted inside and the untrusted outside,
and it really is the part of your network
where we're going to segment off this screened subnet
so we can apply various boundary defenses to protect things
that we need inside of the screened subnet like web servers,
email servers, and other publicly accessible servers
that people need to access from the internet
and from your internal network.
That's the idea of this screened subnet,
is this semi-trusted area.
Now what does this really look like?
Well, here's an example where I have three PCs and a switch.
Now here we're going to see that we can tie this all
into a firewall and allow traffic
to go between certain zones.
Then we have the screened subnet where my email
and web servers are going to be located up there at the top.
Then I have this untrusted
or outside internet zone over there.
Now, if I have this untrusted internet,
am I going to allow traffic to go
to my trusted internal network or my inside network?
Well, no, because I don't trust it.
I don't trust things on the internet.
So the only reason I'd let traffic come in from the internet
to my internal zone or that trusted zone,
is if somebody from inside that zone asked for a resource.
For example, if you're sitting
on your corporate network right now watching this video,
you went and accessed our website to request this video.
You made a request out from the internal zone
to the internet, and that opened up
in your stateful firewall, a port,
that allowed the return traffic to come back in.
So in general, we're going to block most things coming
from the internet to your internal zone,
unless it's specifically asked for by a user
by doing something like visiting a website
or downloading a file.
Now, from my internal zone to my screened subnet, again,
I really don't fully trust that screened subnet.
So I'm going to treat it like the internet
from our internal network.
Here, if we request information from the email
or web server inside of that screened subnet,
we'll get the return traffic
and that's good for us because we want to be able
to get those things.
But in general, we're going to block a lot of traffic
between our internal or trusted zone
and the semi-trusted for screened subnet
that we're talking about.
Then let's talk about the screened subnet
and as it goes over to the untrusted or outside zone.
This screen subnet should always be able
to go out to the internet
and request whatever it wants from the outside.
That's okay.
And then in addition to that,
we're going to have certain things that can come back
into the screened subnet.
For example, if I'm hosting an email server
inside the screened subnet, I'm going to have
to have some ports open like port 25 if I want to be able
to send emails or port 110 if I want to be able
to receive mail using POP3
or port 143 if I want to receive email using IMAP.
These type of email services need to be able
to have inbound traffic from the internet
because that's what an email server is designed to do,
to serve those emails up to those users.
The same thing would hold true for a web server
inside of the screened subnet.
We would have to open up ports 80
and port 443 to allow for unsecure
and secure web browsing from the internet to that web server
that we're hosting inside of our screened subnet.
Now, if we're running a web server, people from outside
of our network will also want to get to those web servers,
but so do people from inside of our network too.
And that's why the screened subnet is considered
to be this semi-trusted zone
because people from outside of our network,
those on the internet, can actually reach in
and touch the devices that are being hosted inside
that screen subnet if those ports are open.
And we don't want people reaching in
and touching our internal network,
so we keep these servers in this semi-trusted zone
called a screened subnet.
Now we can really lock it down
and put a lot of protections in place
because we now have this screened subnet
and we have a choke point in our networks.
So we could put things like intrusion detection systems,
intrusion prevention systems.
We could put things like firewalls
and unified threat management systems
and other things like that to make sure
that we're checking data as it's coming
in to those screened subnets
so we can better protect those web servers
and email servers that we're hosting there.
But if we didn't have any access to the outside world,
this email server and web server wouldn't be very useful,
and it wouldn't provide any kind of functionality
to our users who are locate outside of the network.
And that's the idea of using a screened subnet.
It really is this semi-trusted zone
between our insider trusted zone
and the outside or untrusted zone.
And it's important to understand
how you can use this when you're hosting different servers
and services inside of your networks.