RE: [fw-wiz] Sources for Extranet Designs?

From: Daniel Linder (dan_at_linder.org)
Date: 02/23/04

  • Next message: Steven A. Fletcher: "RE: [fw-wiz] Sources for Extranet Designs?" 
    To: "Baumann, Sean C." <Sean.Baumann@celera.com>
Date: Mon, 23 Feb 2004 14:33:56 -0600 (CST)

    Baumann, Sean C. said:
    [snip...]
    > but there have been requests to allow
    > direct access to DBs and some non-web-based applications. How would you
    > handle granting access to these?

    Is there such thing as a SQL front end proxy? I would think with more
    security devices employing "layer 8" (yeech, marketing speak) filtering a
    SQL security proxy that could be programmed with limits such as
    databases/tables/columns, number of rows returned, etc this might be a
    good first line of defense...

    > So I guess my specific questions are:
    > 1.) If you say you should never allow access to resources on your
    > protected or internal network, how do you handle giving access to
    > services that reside on machines that cannot be duplicated (i.e.
    > expensive mainframes)?

    Does the data have to be real-time, or can pre-programmed batch jobs be
    kicked off to generate the data for the customer? Can your big back-end
    server database be partially replicated to a "disposable" hardened middle
    server?

    > 2.) Do most companies require routable address on their extranet?
    > Currently we use RFC1918 address for our extranet, but we see that this
    > will become a problem in the future as we add partners.

    The easiest way is to use "real" Internet addressable IP addresses, but
    that can be kind of a waste if you don't already have them sitting
    around...

    The RFC1918's are about the easiest to implement if you can do some sort
    of NAT'ing between sites. If both of your internal systems reside on
    conflicting ranges, you can setup the router on your end of the network to
    NAT all traffic to the customer equipment. Then, the customer equipment
    only sees a handfull of IP addresses in a non-conflicting range that it
    has to respond to. 

    -- 
Daniel Linder
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Steven A. Fletcher: "RE: [fw-wiz] Sources for Extranet Designs?"

    Relevant Pages

    • Re: Cost of ownership: MV vs. SQL Server
      ... been developed over 20 years can not be converted to SQL in three. ... > enforcement of of RI in a multi-value system is created at the ... >> I would think that at least a weekly application of security patches ... > "exposed" to the Internet. ...
      (comp.databases.pick)
    • Re: .NET/ODBC queries Via the Internet
      ... Are you worried about SQL injection attacks? ... the internet is not very safe. ... "Samuel" wrote: ... I need to add a web interface to my VB.NET application ...
      (microsoft.public.dotnet.languages.vb)
    • Re: Licensing
      ... employees will be accessing the sql backend, ... Licesing Mode dialog box when installing SQL 2000. ... the Internet or extranet), then the Per Processor license would be ideal. ...
      (microsoft.public.sqlserver.setup)
    • Re: Connecting to DB with Static IP over the internet
      ... I was getting mental over this because the settings on the sql server i did ... item on the connection string. ... stuff from the internet. ...
      (microsoft.public.sqlserver.setup)
    • Re: SQL to combine columns
      ... Let me pull some imaginary money out of my ... Internet, as wonderful as it is, has its limitations. ... Yes, CELKO is a Master at RDBMS, I have just started out and have done ... advanced, in regards to SQL and RDBMS, recent copyright date please? ...
      (comp.databases.ms-sqlserver)