Re: Yet another which firewall? question

From: Volker Birk (bumens_at_dingens.org)
Date: 09/15/05 

Date: 15 Sep 2005 19:23:48 +0200

Paul Welsh <pwelsh@uk2.net> wrote:
> We currently use 2 x ISA 2000 servers and the RainWall clustering
> software to connect our office to the Internet via a 2 Mb leased line.

Sincere condolences. ;-)

> On the LAN are 2 x web servers running IIS and MDaemon. The web
> servers connect to database servers running MS SQLServer. These
> database servers in turn connect to another database server to run
> certain stored procedures, so it's like this:
> Internet - ISA Servers - IIS Servers - SQL Servers - SQL Server
> The web servers run in-house developed e-commerce software that's used
> by internal and external users. There are about 150 users of the web
> site, divided equally between internal and external users.
> Users who access the IIS Servers via the Internet do so via http and
> https only. The only other potential port that needs opening up is
> smtp.
> I'm considering separating out this e-commerce traffic from web surfing
> etc by buying an ADSL connection and directing such non-business
> critical traffic through it, leaving the leased line for the web
> servers.

No problem so far (with the small exception, that you're using security
software from Microsoft of all the possible vendors.

> With two Internet connections comes the need for, potentially, two
> firewall solutions. The ISA servers provide VPN access to remote users
> and we also have SurfControl running on them. It seems that they might
> be best left to serve the ADSL line while the leased line has a
> hardware firewall attached to protect the web servers. No need for
> added extras like VPN access on the leased line firewall.

You should think about a network zone concept first. Perhaps it's a
good idea to start with the classical three zone concept.

> We don't currently have a DMZ.

Change that.

> That's because currently the web
> servers access copy documents from a file server to a temporary session
> area on the web server using a UNC connection before displaying their
> contents to the web users.

This is very ugly.

> 1. Does the idea of separating essential from non-essential Internet
> traffic make sense?

Yes.

> 2. Do you think I should use the two clustered ISA servers for the ADSL
> connection and use a hardware firewall for the leased line traffic?

No. I think, you first should start to design a zone concept, before you're
thinking about anything else.

> 3. My understanding of a DMZ is that it should contain servers that are
> accessed by the LAN and Internet. The IIS servers should clearly be in
> the DMZ. How about the SQLServer servers?

That depends.

> 4. What firewall would be suitable? It strikes me that the price of
> firewalls with DMZ rises dramatically. I also end up paying for VPN
> capabilities which I don't need.

Try to think about Free Software. It's not only free as in free speach,
but good in pricing also.

Yours,
VB. 

-- 
"Es kann nicht sein, dass die Frustrierten in Rom bestimmen, was in
deutschen Schlafzimmern passiert".
                                    Harald Schmidt zum "Weltjugendtag"

Relevant Pages

  • Re: Low power mini-itx system for firewall
    ... and our servers tend to be SCSI). ... there are _firewall_ distributions that don't even need that much. ... get into our internet network, and allowing guest laptops to access only ...
    (comp.security.firewalls)
  • Re: Is this a wise configuration?
    ... A have a single DSL connection to the internet at my house. ... connection goes through a router, ... With this many "test" servers running, however, there are many ... Generally referred to as "DMZ" when you search for firewall info ...
    (comp.os.linux.networking)
  • [fw-wiz] Static NAT not answering
    ... Set up static-nat rule for my web, DNS, Mail servers ... Before, there's no firewall in our company, each ... The static-nat could not work (the external cannot ... cannot access the internet) if we are using ...
    (Firewall-Wizards)
  • Re: DCPROMO FAILED
    ... What on the firewall could stop the root servers from accessing the ... prevent internal servers from recursing the Internet. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Device/Firewall for SOHO in AD 2003 Env
    ... > firewall function is usually just a port blocker - nothing too advanced ... >> We have three servers with its own web contents available on the ... >> Internet. ... >> I want a firewall device to block everything except the web sites ...
    (microsoft.public.win2000.active_directory)