# Network Guys v Security **URL:** \ **Category:** NYSpeed Off Topic\ **Created:** [February 27, 2009, 7:00am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706 "2009-02-27T07:00:39Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 27, 2009, 7:00am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/1 "2009-02-27T07:00:39Z")
For more big business and enterprise networks, we were discussing the policies you have between zones. I had a discussion with a customer and some co workers about security in their local networks and also outbound to the internet and curious anyone who has dealt with enterprise networks, what policies you setup. What services to you permit outbound to the internet? What security do you have between zones? Everyone in a Trust zone or did you break up your network if users are only in subnets for their buildings and anyone on the network is trusted to get to everyone? ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 27, 2009, 7:01am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/2 "2009-02-27T07:01:32Z")
👋 Outbound usually only http/https…and with that most enterprises will run a proxy… Exceptions were based on departments with managers signing off… The site to site trusts thing really depends on the applications people are running… I have implemented egress filtering at a ton of customers purely as a response to machines getting infected and spamming(port 25)…or people trying to use peer to peer shit at work. ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 27, 2009, 7:17am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/3 "2009-02-27T07:17:51Z")
permitting outbond service really just depends on the services needed. Where I am, we run a lot of specialized applications and require many different types of outgoing traffic on all different ports ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 27, 2009, 7:57am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/4 "2009-02-27T07:57:14Z")
Risk mitigation! ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 27, 2009, 8:21am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/5 "2009-02-27T08:21:59Z")
> [@LZ](#): > > I have implemented egress filtering at a ton of customers purely as a response to machines getting infected and spamming(port 25)…or people trying to use peer to peer shit at work. Ya. The project started off as “We don’t care who can get to what.” and now they found out their IPs are getting blacklisted becuase they are spamming port 25 outbound. I told them I am rewriting the policies and only going to allow from the general data subnets: HTTP, HTTPS, FTP, SSH, TELNET, and ICMP and then limit their SMTP service out to only their mailserver. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 27, 2009, 8:23am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/6 "2009-02-27T08:23:54Z")
I just setup Splunk and showed them all their IPs that are hammering the internet with traffic and now they suddenly are like, well we should rewrite our policies. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 27, 2009, 8:28am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/7 "2009-02-27T08:28:14Z")
Clients have no reason to use port 25 anyways… ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 27, 2009, 8:46am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/8 "2009-02-27T08:46:03Z")
> [@LZ](#): > > Clients have no reason to use port 25 anyways… Ya. I was blown away that they were finding reasons to keep Yahoo Messenger and all the other default protocols allowed on the outbound side when they have such strict web filtering rules… I guess they learned now I have to go and just restrict their outbound/inbound. Exchange uses SMTP on port 25 right for outbound email or does it get creative and use some other random port for its mail? ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 27, 2009, 8:57am UTC](https://forums.speedlife.net/t/network-guys-v-security/63706/9 "2009-02-27T08:57:12Z")
Exchange uses 25 for outbound…