RE: Layer 4 switch vs. firewall

[agetchel () kde state ky us]

        I believe the keywords here are 'if you are physically present'.
It's easy if you are standing right next too the switch to unplug your
laptop from a port which is in one VLAN to a port which is in another VLAN
and reconfigure your box.  Of course one would hope that an organization
concerned in protecting their assets through electronic security measures
are just as concerned about protecting their assts through physical security
measures as well.  This is, however, unfortunately not the case the majority
of the time.  It doesn't do much good in putting in a
wiz-bang-best-of-breed-kick-butt firewall if someone can walk into one of
buildings and plug up to a switch at will.

Thanks,
Abe

Abe L. Getchell - Security Engineer
Division of System Support Services
Kentucky Department of Education
Voice   502-564-2020x225
E-mail  agetchel () kde state ky us
Web     http://www.kde.state.ky.us/



> -----Original Message-----
> From: hesselsp () ashaman dhs org [mailto:hesselsp () ashaman dhs org]
> Sent: Monday, February 19, 2001 3:45 PM
> To: Tony Miedaner
> Cc: firewall-wizards () nfr net
> Subject: Re: [fw-wiz] Layer 4 switch vs. firewall
>
>
> I find this interesting.  I have not read anywhere about 
> someone getting
> around VLAN'd switches.  I read on bugtrac that it might be 
> possible to
> inject garbage packets into a different vlan, but I was not aware of
> anyone doing anything useful with it.
>
> Can you please elaborate?  Thank you,
> Paul 
>
> On Thu, 15 Feb 2001, Tony Miedaner wrote:
>
> > It depends on what you are protecting doesn't it.
> >
> > If you are physically present, VLAN'd Switches alone are 
> easy to get around.
> > Layer 3/4 access lists are also easy to get around - change 
> your IP and
> > hookup to the right port and you are talking to something.
>
> -- 
> --Paul
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () nfr com
> http://www.nfr.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards