We will all no doubt work on network setup at some juncture including VLAN configuration.
For those doing multiple deployments, or larger deployments, how do you test inter VLAN rules etc. are well configured and working as intended?
Is there FOSS available to assist with this and possibly even test configuration periodically?
I use ping to validate if I can reach the other network. If want to check ports nmap works for that.
I’m just surprised most people keep it that simple, that there aren’t monitoring tools/scripts to test them for changes.
Scripting nmap is easy to do. But I don’t bother.
Most LAN filters are generally the same and don’t change. If your default rule is to block, it becomes a lot more difficult to allow unwanted traffic. After awhile, most people find reading the config file is as easy as reading a book. I only test with nmap if the new rule is unique or complicated. Or I’m bored.
Simple solutions are best solutions.
It would not be hard to build out alerting but does not really feel needed. If someone gets access to the firewall they don’t usually change the rules, they pivot from the access they have gained from the firewall.
I don’t think he’s worried about that. Exploiting poor east-west filter rules is one thing, exploiting filter rules to your router is another thing all together. I believe he was concerned about east-west traffic.
In the best networks, the router(s) has no internal services requiring open ports. So there is nothing from a exposed-service perspective to exploit. You can take that whole threat landscape off the table. Or more accurately said, shift each service to siloed container environment where the risk (and update cycle) can be isolated.