RE: DMZ - Question

I am working with 2 pix firewalls, and I am hoping to change
FW-2 to a different brand that has stateful inspection.

Are you saying that you don't think the PIX is stateful? I'm
absolutely certain that it is.
However, you are correct that the only way to make this sort of
two-firewall design more secure than a single-firewall design (with
three interfaces: Internet, LAN and DMZ) is to use different products
for the two firewalls so the defects of one are not duplicated by
the other.

One of my questions is the DMZ is in a /24 subnet and the LAN
is on a /16 subnet. Is the only way for the web server in the
DMZ to communicate with the inside LAN by NATting in the
FW-2. Isn't this creating a double subnet from the outside??

No. Assuming that these are public addresses, the /16 is broadcast
as a summary route, and the /24 is only visible locally. (I strongly
suspect, however, that if you're using a /16, it's probably on a
private (RFC1918) range, and so will not be advertised at all.)

David Gillett


-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of hol64@xxxxxxxxxxx
Sent: Friday, October 26, 2007 8:41 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: DMZ - Question

I have to setup a DMZ on our network. Our current layout is
Internet Router <--> Firewall <--> WAN/LAN Router <--> Servers

The idea is to setup a back-to-back DMZ or Dual Firewall DMZ.
So the topology would be like this..
Internet Router --> FW-1 <--> DMZ <--> FW-2 <--> WAN/LAN router.

On the DMZ we will have a Web Server that needs access back
to the Mainframe on the LAN, and a Mail server that need
access to another mail server on the LAN.

One of my questions is the DMZ is in a /24 subnet and the LAN
is on a /16 subnet. Is the only way for the web server in the
DMZ to communicate with the inside LAN by NATting in the
FW-2. Isn't this creating a double subnet from the outside??

I am working with 2 pix firewalls, and I am hoping to change
FW-2 to a different brand that has stateful inspection.


Please Advice,

Thanks,

Pablo


Relevant Pages

  • Re: Joining web server to SBS domain - any pre-cautions?
    ... I'm trying to plan for joining our web server (Server 2003 Std. ... You should have a REAL FIREWALL APPLIANCE, ... A single public IP can provide HTTP access for the DMZ Network and also ... If you firewall has a DMZ and it's in the same Subnet as the LAN, ...
    (microsoft.public.windows.server.sbs)
  • Re: DMZ and file sharing
    ... Never ever use DMZ, a) its an open unlocked door with a big sign saying your ... save/retreive files to/from a restricted area on the LAN. ... and only server. ... You need to consider the safety of the LAN when the web server gets ...
    (microsoft.public.windows.server.sbs)
  • Re: Adding a web server to my network
    ... I have a LAN behind a hardware firewall connecting to the web by DSL. ... I would like to keep my LAN safe from hackers, and my web server safe ... region is called the DMZ, which is where you put your web ...
    (comp.os.linux.misc)
  • Authentication on a web server via AD
    ... But I have som rules that I have to follow. ... The web server is located on a dmz ... The active directory controller is located on lan ... I can not open any port from dmz to lan ...
    (microsoft.public.isa)
  • Re: Firewall and DMZ topology
    ... attacker cannot spread his influence across the network. ... If the DMZ resides between the public Internet and the ... Should the DMZ be behind the LAN and not split off at the firewall, ... > The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
    (Security-Basics)