The four most important integrated designs for the e-commerce submodule are as follows:
- Base design
- Dual layer firewall design
- SLB one-armed mode with dual layer firewall design
- SLB one-armed mode with security contexts
E-Commerce Base Design
The e-commerce base design involves a three-tier topology, with a dedicated Core Layer, Aggregation Layer, and Access Layer (which contains Web, applications, and database servers).
Figure 8.9 – E-Commerce Base Design
This is a fully redundant design, with each layer having devices in active/active or active/passive configuration, as presented in Figure 8.9 above. The Core Layer devices, as well as the Aggregation Layer devices, are connected through trunks (often port-channel links). The Aggregation Layer to Access Layer connection is often a trunk that carries VLANs that group the services contained in the Access Layer:
- Web VLAN
- Aggregation VLAN
- Access VLAN
The Core Layer usually contains Cisco Catalyst 6500 devices and ensures redundant connections to the ISP. The Core Layer Cisco 6500 chassis usually contains firewall service modules that move the firewall perimeter to the Core Layer, making the Aggregation Layer a trusted zone.
One of the major disadvantages of the base design topology is that it does not offer security features between the Web, application, and database zones. One way to solve this issue is to implement private VLANs.
The Aggregation Layer supports the SLB submodules, and the default gateway for the e-commerce servers is the virtual IP address on those submodules, meaning all of the e-commerce traffic will pass through the SLB submodules at the Aggregation Layer. The Access Layer switches are usually Layer 2 devices and they connect the Web servers, the application servers, and the database servers.
From a routing standpoint, static routing will mainly be used toward the Core Layer. At the Core Layer, either static routes or dynamic protocols (BGP) can be used to connect to the ISP. In the e-commerce base design, only a single firewall layer will be positioned at the Core Layer, but if there is extra funding and personnel, a dual layer firewall design can be implemented.
E-Commerce Dual Layer Firewall Design
The dual layer firewall design is similar to the e-commerce base design, with the exception of adding a firewall in the Aggregation Layer, as shown in Figure 8.10 below:
Figure 8.10 – E-Commerce Dual Layer Firewall Design
To implement the second layer of firewalls, ASA devices or dedicated firewall modules can be placed between the Core Layer devices and the Aggregation Layer switches. The second layer of firewalls can be placed either in a classic routed mode or in transparent mode, which is commonly done in modern designs.
The advantage of this solution is that it offers an extra layer of security for the backend servers in situations where the Core Layer switches are compromised and the first firewall layer is breached. In this design, the perimeter firewalls at the Core Layer provide security services and make policy decisions, while the Aggregation Layer firewalls form an internal DMZ perimeter that protects the servers. Similar to the base design, there are still content switch modules at the Aggregation Layer making SLB decisions.
E-Commerce SLB One-Armed Mode with Dual Layer Firewall Design
The SLB one-armed mode with dual layer firewall design is a modification of the dual layer firewall design that separates the content services module from the Aggregation Layer switch. Instead of using an integrated design with the load balancer device in the same chassis as the Aggregation Layer switch, an SLB one-armed topology is used, as shown in Figure 8.11 below:
Figure 8.11 – E-Commerce SLB One-Armed Mode with Dual Layer Firewall Design
This design will use the same VLAN separation presented before (i.e., separate Web, application, and database VLANs), and the server’s default gateway will still be the primary IP address on the Aggregation Layer devices. The major difference from previous design models is that policy-based routing or client-side NAT must be used to redirect the outbound server traffic.
E-Commerce SLB One-Armed Mode with Security Contexts
The e-commerce SLB one-armed mode with security contexts design is similar to the previous model, except for the way the firewalls work at the Aggregation Layer. This design provides increased convergence by running the firewall modules in transparent mode, basically functioning as Layer 2 bridges. The SLB component performs routing between the Aggregation Layer and the Core Layer.
The firewall contexts feature is leveraged on the Aggregation Layer submodules to create multiple virtual firewalls on a single physical device. Outbound traffic from the servers passes through the Aggregation Layer firewall modules, and then it is routed to the SLB component using policy-based routing, before reaching the Core Layer.