Networks

Ask something
Question Locked

DMZ configuration

0 helpful
5 replies

by dhegner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello All,
I'm in the middle of a SAS 70 audit and I have been asked to incorporate a DMZ into my infrastructure. I have done something similar in the past with servers and IP forwarding but this is a little foreign to me. I've done some research and I believe that a Multi-Homed Bastion Host configuration is what I need. I must work with existing equipment and I have only one firewall available at the location in question so this looks like the best solution.

In the Multi-Homed Bastion Host configuration a single Firewall is used with individual subnets for the Internal Network, the DMZ and of course the Internet. This I have no problem with .... my confusion comes from the configuration of the Firewall.

How should I configure the Firewall to achieve the best security scenario? The web server runs 4 web applications in addition to hosting our web site. I'm not an SQL guru so I'm unclear on how the web applications communicate with the database server on the back end. Do the two servers need to be able to communicate via a VPN or static route or will the SQL applications be able to find the Database server via SQL connection strings without a route through the firewall? If I use a static route I don't see a security advantage. Should I use a VPN between the DMZ and the Internal network? If so does this provide the level of security I am looking for? Seems to me that with the VPN in place a hacker could access the internal network just as easily as if the Web server was in the same subnet as the other servers. I have never been a packet level guru so I'm foggy on how the DMZ actually provides additional security.

Lastly, with the DMZ in place how can I remotely administer the Web server?

I've asked a lot of questions here but any help would be appreciated.

Thanks,
DH

5 replies

by retro77

The best way to setup a DMZ is with what we call a 3 legged firewall. It will have one Internet connection coming in, then on 'leg' going to your DMZ with its own set of firewall rules and another 'leg' going to your protected zone [LAN].

I wouldn't mess with dual homed servers. If the public side of that server is comprimised, then and attacker is in your protected zone.

by cg it

if your current firewall solution supports multi-subnet capabilities [routing multiple subnets via multiple interfaces] and it's currently configured to route traffic only through 1 interface, then the only configuration changes needed are in the routing tables. example, port 80 is routed through a single interface. the change is now port 80 traffic will be routed through a different interface [subnet that is DMZ for web servers].

One of the problems with web servers with DBs attached to them is that the DBs are targets for attack. The only secure senario I know of is perimeter firewall >>>> DMZ/web server>>>firewall/proxy>>> DBs. And that is using ISA server 2004/2006. ISA between the DBs and the DMZ will assure that no actual external traffic gets in to the DBs. It acts as a proxy.

With only 1 firewall in the mix,and it's not a proxy server as well, to allow external traffic in to web servers, you create a hole in the firewall [allow port 80 traffic in].The more holes you have to open in the perimeter firewall to allow external users use of services, the more holes prone to attack.

Since web servers are prone to attack, most companies either farm out web site hosting or have web sites going to an public address reserved soley for web servers and is not one that any company network traffic uses.

by animatech

I agree with CG IT.
I think for your scenario you might want to consider if you want to use a DMZ as with 1 firewall you will have to open more ports in your firewall.
IP filtering will not provide you with more protection as well.
I have included 2 links one of them is showing DMZ scenarios with ISA server and the other is against DMZ.
Have a read and decide what you want to do
http://tinyurl.com/4mhw
http://tinyurl.com/35whch

This discussion is closed to new replies.