networking-forum.com
Community BlogCommunity Wiki * Register  * Search  * Login
View unanswered postsView active topics

All times are UTC - 6 hours [ DST ]



Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: PCI DSS
PostPosted: Tue May 01, 2012 10:01 am 
Offline
New Member
New Member

Joined: Sun Aug 03, 2008 9:35 am
Posts: 40
Location: Perth, Australia
Certs: CCNP
Hi All,

Does anyone here have to manage a PCI DSS compliant environment? If so, any tips on designing and building a network focused around PCI compliance? At the moment I'm still picking up the pieces where I am, but most of the environment goes against all good design policies. Collapsed core, with layer 2 from access all the way to the core...

We have 3 sites, all connected by VPLS(which by the way is horrible) and the VPLS connects into the core switches at each location. None of the core does any real routing except at the office data centre where it is the first hop for a number of VLAN's but even then the VLANs cant be terminated there, as other devices at other sites exist on those VLANs. All routing is done by checkpoint firewalls at the primary and DR sites, with the Checkpoints in a VRRP cluster, and not load balanced. Essentially, everything is reliant on the firewalls which is a horrible idea because it's slow, and Checkpoint are flaky at best. STP is a pain to manage across 3 sites with VPLS, and having such a large impact domain makes the network quite fragile.

So it sounds like they went with this design for a few reasons:

1) The systems team wants L2 between all sites so that they can fail to a DR host without failing over an entire subnet - they just bring up the active IP on the host at another location and away they go.

2) They put everything through the firewalls so it can be logged and because PCI requires firewalling between cardholder environments, etc. Any thoughts on better ways of doing this? The firewalls are the real problem in that amongst a lot of other problems, they don't really do dynamic routing very well, so I can't really migrate us to a true HA L3 core with that kind of hinderance.

Anyways, I'm not hugely experienced with this kind of network design - my most networking orientated gig before this was work for a hosting provider on their edge, so I was dealing with BGP and MPLS all day long... Almost have my CCNP just got a little to learn so not fully up to date there either.

Anyways, would be nice to hear from others with experience in this realm and how they have done things, and based on other experiences, hopefully can work out some ways forward. Obviously it is going to take quite some time to make changes, as big changes move very slowly in environments like this.

Cheers,

Mark


Top
 Profile  
 
 Post subject: Re: PCI DSS
PostPosted: Tue May 01, 2012 11:08 am 
Offline
Post Whore
Post Whore
User avatar

Joined: Fri Apr 25, 2008 2:16 pm
Posts: 1375
Location: Jacksonville, FL
Certs: CCNP, CCNA:Sec, MCSE
I work for a eCommerce company who is compliant with PCI-DSS 2.0 as a Level2 merchant. The easiest thing to do is to limit your cardholder environment as much as possible, to keep the scope small.

If your firewalls are the problem, replace them; failing PCI compliance is more expensive than replacing a few firewalls or redesigning your network.

_________________
"A problem well stated is a problem half solved". (Charles Kettering)


Top
 Profile  
 
 Post subject: Re: PCI DSS
PostPosted: Tue May 01, 2012 11:29 am 
Offline
Ultimate Member
Ultimate Member
User avatar

Joined: Thu Nov 04, 2010 9:55 am
Posts: 937
Location: Austin, Tx
Certs: CCNA
As Dinger said, keep the scope as small as possible. Anything that crosses or has any kind of access to your cardholder environment/vlan will bring that vlan/network into your PCI scope which brings things that have access to that into the scope etc and it can snowball from there.

_________________
The best part about telling UDP jokes is I don't really care if you get them or not.


Top
 Profile  
 
 Post subject: Re: PCI DSS
PostPosted: Tue May 01, 2012 7:09 pm 
Offline
New Member
New Member

Joined: Sun Aug 03, 2008 9:35 am
Posts: 40
Location: Perth, Australia
Certs: CCNP
Thanks Guys.

Understood about limiting scope, that is essentially what we have done, through the use of an abundance of VLAN's. I guess I'm not really looking for tips on how to be compliant(as we are PCI DSS 2.0 Level 1 Compliant already) but more around ways to make the network more traditionally designed, without relying on the firewalls. Also how you did Layer 3 segmentation as opposed to Layer 2 would be awesome.


Top
 Profile  
 
 Post subject: Re: PCI DSS
PostPosted: Tue May 01, 2012 7:42 pm 
Offline
Post Whore
Post Whore
User avatar

Joined: Fri Apr 25, 2008 2:16 pm
Posts: 1375
Location: Jacksonville, FL
Certs: CCNP, CCNA:Sec, MCSE
At least according to my auditors, they only care about the in-scope VLANS and the card-holder environment. They don't care about how the rest of the network is designed.

_________________
"A problem well stated is a problem half solved". (Charles Kettering)


Top
 Profile  
 
 Post subject: Re: PCI DSS
PostPosted: Wed May 02, 2012 8:11 am 
Offline
Post Whore
Post Whore
User avatar

Joined: Sat Oct 20, 2007 11:05 am
Posts: 1953
Location: Plano, TX
Certs: CCNA
From the PCI manual-
Quote:
The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements are applicable if a
primary account number (PAN) is stored, processed, or transmitted. If PAN is not stored, processed or transmitted, PCI DSS requirements do not
apply.

This means that any device that does this is in scope. If an ESX host has an in scope VM, all VMs on that host are in scope. If a cor switch has a VLAN that is in scope, the whole switch is in scope.


Top
 Profile  
 
 Post subject: Re: PCI DSS
PostPosted: Wed May 02, 2012 10:30 pm 
Offline
New Member
New Member

Joined: Sun Aug 03, 2008 9:35 am
Posts: 40
Location: Perth, Australia
Certs: CCNP
My question wasn't around what is in scope or out of scope, but more around Layer 3 network design as a whole. And FYI, anything with Cardholder Data, whether PAN or not, is in scope for us, but yes, networks with PAN are most important, and as such we physically and logically segregate, with no routing in or out.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 6 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 8 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group