Re: DMZ - Question

On 2007-10-26 hol64@xxxxxxxxxxx wrote:
I have to setup a DMZ on our network. Our current layout is Internet
Router <--> Firewall <--> WAN/LAN Router <--> Servers

The idea is to setup a back-to-back DMZ or Dual Firewall DMZ. So the
topology would be like this.. Internet Router --> FW-1 <--> DMZ <-->
FW-2 <--> WAN/LAN router.

On the DMZ we will have a Web Server that needs access back to the
Mainframe on the LAN, and a Mail server that need access to another
mail server on the LAN.

Bad idea. You don't want hosts in the DMZ to be able to establish
connections into the LAN. That would be breaking the concept of a DMZ
(allow connections from a network with higher security level to a
network with lower security level, but not vice versa).

There are several ways to deal with this problem, e.g. replicate the
information from the servers into the DMZ, use bastion hosts, or put
the servers from the LAN into a second DMZ.

One of my questions is the DMZ is in a /24 subnet and the LAN is on a
/16 subnet. Is the only way for the web server in the DMZ to
communicate with the inside LAN by NATting in the FW-2. Isn't this
creating a double subnet from the outside??

Actually the subnets don't matter at all, as long as you're using
differnet address ranges for both networks. Of course you can do
double-NAT, but usually that won't be necessary. Even if both networks
have private IP addresses, you can route between LAN and DMZ as long as
you do NAT towards the Internet.

What address ranges are we talking about, anyway?

I am working with 2 pix firewalls, and I am hoping to change FW-2 to a
different brand that has stateful inspection.

Ummm... AFAIK PIXs do stateful inspection.

Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

Relevant Pages

  • Re: Firewall and DMZ topology
    ... attacker cannot spread his influence across the network. ... If the DMZ resides between the public Internet and the ... Should the DMZ be behind the LAN and not split off at the firewall, ... > The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
    (Security-Basics)
  • Re: Web portal security
    ... win2003 standard server with IIS, SSL enabled and will be placed on ... So I will be fwding port 443 in firewall to my DMZ port. ... Well, assuming you are going to use teh SQL database from SBS, you can ... subnet than my LAN and map one to one from firewall to dmz. ...
    (microsoft.public.windows.server.sbs)
  • Re: 2 NICs Configuration Problem
    ... Servers on the DMZ are public, ... provides NAT for the LAN machines, allowing them to reach the Internet ... effectively bypassing firewall filtering to that server. ... Ethernet adapter Server Local Area Connection: ...
    (microsoft.public.windows.server.networking)
  • Re: Where to put the server
    ... Put the 2003 IIS Server in the DMZ. ... SBS box or another LAN server. ...
    (microsoft.public.backoffice.smallbiz2000)
  • RE: fedora-list Digest, Vol 6, Issue 266
    ... Re: OT: Setting up a forwarding mail domain in DMZ without ... Re: Sound Problem ... downloaded the yum.conf for fedora from Redhat's website. ... Server: Fedora.us Extras ...
    (Fedora)