is a sacrificial lamb wise?

This is not a dmz... dmz is a zone defined as sitting between the Internet and an internal network's line of defense; usually it is some combination of firewalls and bastion hosts.

Typically, the DMZ contains devices accessible to Internet traffic, such as Web (HTTP) servers, FTP servers, SMTP (e-mail) servers and DNS servers.

A Demilitarized Zone is used by a company that wants to host its own Internet services without sacrificing unauthorized access to its private network.

Thereare three common scenarios:
1) No DMZ and no firewall -- which are usually very small home systems connected to cable or dsl. This is the least secure.
2) No DMZ but a firewall or a form of a firewall -- which is your situation.
3) Both a DMZ and one firewall defending the internal network from access; some external servers on the external side of the firewall and then another firewall on the outside of that server (or servers).

Needless to say, the third is the most secure. Yours is the middle, and the First is the lease secure.

Now there are a whole bunch of degrees of security between these three scenarios... for instance a hardware firewall is considered more secure than a software firewall. Some hardware firewalls operate on the basis of NAT, etc. which is not totally secure either.

Anna has it right.

I'll add that on small home networks that use routers, their DMZ is exposed to both inbound and outbound traffic with no protection from the routers firewall [re blocking WAN pings,IGMP, PPTP,L2TP and default blocking of all ports until specified via port fowarding.

If one was smart, one would put a web server they didn't care if it got hacked into on a DMZ with a standard software firewall and antivirus. Sorta like a diversion tactic. Internet hackers using sniffers or scanners would be attracted to the web server and not the actual network.

For the major network, use two firewalls. A hardware /Router and something like ISA server between the network and the external world.

Correct! A DMZ is a 'gap' between two (or more) firewalls, that effectivy does this

Lan---|FW|xxxDMZxxx|FW|=========Internet

By placing the SMTP server in the DMZ, you are offering it protection from the first firewall. DMZs CANNOT be created without 2 ore more firewalls. Now, DMZs have things such as FTP, HTTP, SMTP, RAS(oPPP), App Proxy, etc, since the first firewall, although not too constricting, is giving those servers protection. And by having a highly constricting second one, you limit dmage to the internal network, where things such as RMDBs, proxys (again), w/s etc.

I know it probably isnt clear, but I have the flu and I am really tired. So I apologise for the high amount of verbage...

Maelgwyn

First-

A single FW can provide for a DMZ. It should have more than one interface, however, to separate the networks.

Second-

Yes, a router can be configured as a firewall. But it's not much of one if you're allowing everything through. You would have to at least use some access lists, but that's really not going to cut it.

The whole idea with firewalls is that you close everything, and only allow what you want or need through it.

So, third-

No, I would not think that the SMTP server is very safe in the last scenario you illustrated.

Fourth-

Add comments to your original posting. You won't have to reject an answer if you don't want to. We will stil look there for your comments.

Here are my thoughts on this.
Technically, a single firewall does not make a DMZ, like others have said. DMZs are protected logically on both sides, the LAN side and the Internet side. Your scenario states that the SMTP server is open on the Internet side.
So, tell your network person to stop calling it a DMZ. You can't even call it a screened host, since the server is not screened by anything!

The only way a single firewall can make a DMZ is if the firewall has multiple network cards andmultiple IP addresses, and traffic comes into one side and goes out another to make the DMZ network. But it does not sound like this is the case in your network.

Ok, you "could" set up a router with the ACL set to have a lower deny any-any all-all rule, then build allow rules above that one, but I would not call this "firewalled" either. Plus, using a router to do your filtering is going to drastically increase the CPU load on the router, which could decrease performance.

If it were me, I would be screaming to get another PIX, or some other firewall.

Also, the SMTP server is at least on another network as the rest of your LAN, right? Its network portion of its IP address is different from your LAN? I hope so!

Good luck on this.

There are numerous way in setting up a DMZ zones. As mentioned, your current design does not caters for one.

Two most common method of setting up a DMZ is the sandwich method and the single gateway method. (Some network which have multiple DMZ have a more complex design.)

Sandwich
Internet---Firewall---DMZ---Firewall---Internal

Single Gateway
DMZ
/
Internet---Firewall
\
Internal

Both design can offer you the same level of security, provided the fw policies are defined properly. However the Sandwich configuration does offer additional security, when the fw is the victim, as the intruder would need more time to penetrate the second fw to access the Internal network. Thus giving administrator more time to respond.

Sandwich configuration also offers better performance as the task for policing the DMZ and the Internal is divided between two fw.

Single gateway design is more cost effective, and usually suitable for companies which provide minimal incoming services and does not provide mission critical services. E.G Only company webserver or mail.

Several questions you need to ask when deciding which design to use.
1. What is the level of security does the company require.
2. How mission critical is the Internet services the company offers.
3. How much are the company willing to pay for security.

Sad to say in IT, the higher the price the better the solutions ... be it isproducts or services.

You might consider adding an addtional interface into the the PIX firewall, if upgradable and go for a single gateway. Else if the only way you can get another interface is to upgrade to a new model, then might as well go for the sandwich.

No, it is the norm to make all the ports blocked, bar for the ones that you use, for it is a major security hole.

Yes, that is what I would do, and make it so that the port on the LAN side is not a standard 110 (is that the standard? Bleck)

Anywho, hope this helps more. If it doesnt, send me an email, and I will fix it up, mmkay? My email is robert@keato.zzn.com

Maelgwyn