3 ms·

> I understand a university lacking the IPv4 address space to allow arbitrary incoming traffic (although IPv6 can solve a large chunk of that problem), but why

> I understand a university lacking the IPv4 address space to allow arbitrary incoming traffic (although IPv6 can solve a large chunk of that problem), but why on earth would you block outgoing ports from a research institution? Because production and research networks should be separate. If there's IP network research going on, it should be isolated from your labs, printers, secretaries, etc. * https://en.wikipedia.org/wiki/Science_DMZ_Network_Architecture https://en.wikipedia.org/wiki/Science_DMZ_Network_Architectu... > At my university, every device gets a fully reachable IPv4 and IPv6 address, optionally coupled with a subdomain. Does that include all the Windows desktops in Finance? Your Oracle/SAP HR servers? Does each "device" you reference also include the SCADA stuff that Facilities uses to monitor environmentals? There are plenty of devices at an university that should have outgoing (and incoming) filtering.

jeroenhd 5y ago
As far as I know, yes, everything is connected to the internet with publicly reachable IPs, although some departments are usually placed behind an extra firewall. My university does do filtering, taking action against port scans, traces of active malware, even does some DNS introspection I'm not 100% on board with. Those desktops in Finance and those servers should have decent firewalls on them anyway, locked down with software policies. An extra layer of firewalls against arbitrary incoming connections is probably also for the best. Outgoing connections, though? Only blocked to known malware domains as far as I know. There's a third party that does network upstream that further monitors the security so I don't know the details on that, but I do know (and have run into this myself) that a mere lookup of a malware domain will get your network connection jailed. I don't know about any IoT crap in use for monitoring. That stuff should be on a completely separate network anyway, behind many layers of VLANs, firewalls and static routes, because the tech simply cannot be trusted. If you mix Facilities and IoT into one network, you're bound to have problems, no matter the great firewall you put around the network perimeter. My experience is mostly from the student side of things, but the system for registering WiFi and ethernet devices is not different from the employee side of things outside the OAuth authentication flow.
- throw0101a 5y ago
  > My experience is mostly from the student side of things Yes, and the author of article is writing from IT side of things, and he has to deal with non-student things as well.

jeroenhd 5y ago

As far as I know, yes, everything is connected to the internet with publicly reachable IPs, although some departments are usually placed behind an extra firewall. My university does do filtering, taking action against port scans, traces of active malware, even does some DNS introspection I'm not 100% on board with. Those desktops in Finance and those servers should have decent firewalls on them anyway, locked down with software policies. An extra layer of firewalls against arbitrary incoming connections is probably also for the best. Outgoing connections, though? Only blocked to known malware domains as far as I know. There's a third party that does network upstream that further monitors the security so I don't know the details on that, but I do know (and have run into this myself) that a mere lookup of a malware domain will get your network connection jailed. I don't know about any IoT crap in use for monitoring. That stuff should be on a completely separate network anyway, behind many layers of VLANs, firewalls and static routes, because the tech simply cannot be trusted. If you mix Facilities and IoT into one network, you're bound to have problems, no matter the great firewall you put around the network perimeter. My experience is mostly from the student side of things, but the system for registering WiFi and ethernet devices is not different from the employee side of things outside the OAuth authentication flow.

throw0101a 5y ago
> My experience is mostly from the student side of things Yes, and the author of article is writing from IT side of things, and he has to deal with non-student things as well.