RE: DMZ - Question



I am working with 2 pix firewalls, and I am hoping to change
FW-2 to a different brand that has stateful inspection.

Are you saying that you don't think the PIX is stateful? I'm
absolutely certain that it is.
However, you are correct that the only way to make this sort of
two-firewall design more secure than a single-firewall design (with
three interfaces: Internet, LAN and DMZ) is to use different products
for the two firewalls so the defects of one are not duplicated by
the other.

One of my questions is the DMZ is in a /24 subnet and the LAN
is on a /16 subnet. Is the only way for the web server in the
DMZ to communicate with the inside LAN by NATting in the
FW-2. Isn't this creating a double subnet from the outside??

No. Assuming that these are public addresses, the /16 is broadcast
as a summary route, and the /24 is only visible locally. (I strongly
suspect, however, that if you're using a /16, it's probably on a
private (RFC1918) range, and so will not be advertised at all.)

David Gillett


-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of hol64@xxxxxxxxxxx
Sent: Friday, October 26, 2007 8:41 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: DMZ - Question

I have to setup a DMZ on our network. Our current layout is
Internet Router <--> Firewall <--> WAN/LAN Router <--> Servers

The idea is to setup a back-to-back DMZ or Dual Firewall DMZ.
So the topology would be like this..
Internet Router --> FW-1 <--> DMZ <--> FW-2 <--> WAN/LAN router.

On the DMZ we will have a Web Server that needs access back
to the Mainframe on the LAN, and a Mail server that need
access to another mail server on the LAN.

One of my questions is the DMZ is in a /24 subnet and the LAN
is on a /16 subnet. Is the only way for the web server in the
DMZ to communicate with the inside LAN by NATting in the
FW-2. Isn't this creating a double subnet from the outside??

I am working with 2 pix firewalls, and I am hoping to change
FW-2 to a different brand that has stateful inspection.


Please Advice,

Thanks,

Pablo




Relevant Pages

  • Re: Joining web server to SBS domain - any pre-cautions?
    ... I'm trying to plan for joining our web server (Server 2003 Std. ... You should have a REAL FIREWALL APPLIANCE, ... A single public IP can provide HTTP access for the DMZ Network and also ... If you firewall has a DMZ and it's in the same Subnet as the LAN, ...
    (microsoft.public.windows.server.sbs)
  • Re: DMZ and file sharing
    ... Never ever use DMZ, a) its an open unlocked door with a big sign saying your ... save/retreive files to/from a restricted area on the LAN. ... and only server. ... You need to consider the safety of the LAN when the web server gets ...
    (microsoft.public.windows.server.sbs)
  • Re: Adding a web server to my network
    ... I have a LAN behind a hardware firewall connecting to the web by DSL. ... I would like to keep my LAN safe from hackers, and my web server safe ... region is called the DMZ, which is where you put your web ...
    (comp.os.linux.misc)
  • Authentication on a web server via AD
    ... But I have som rules that I have to follow. ... The web server is located on a dmz ... The active directory controller is located on lan ... I can not open any port from dmz to lan ...
    (microsoft.public.isa)
  • RE: Possible method to prevent spread of CodeRed and other simila r wo rms
    ... Restricting tcp/port80 initiated outbound connections from the DMZ is an ... I'll assume you've group your web server objects ... residing in the DMZ (ex. ... The primary reason that I can think of for a web server to initiate Internet ...
    (Incidents)