Networks

Ask something
Discussion Locked

Need help on a hardware firewall setup

0 helpful
5 replies

by whatme?

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I would like to set up a hardware firewall, specifically a SonicWall 100 with a DMZ. My existing configuration may make this difficult though. Does anyone have any recommendations as to how I can accomplish this?
I have 5 separate physical sites, each with a DC w/DHCP,DNS and global catalogue. All sites including the routers are private addressing and routed to only one site with an IP gateway. I have a limited number of valid IP addresses to use for my DMZ. Now physically, I only have one circuit coming into each site. At site 5 (my Gateway) I still only have one circuit coming into the building.
Addressing as follows:
Site 1. router:LAN 172.20.140.254 into my DC: 172.20.140.1
Site 2. router: LAN 172.21.140.254 into my DC: 172.21.140.1
Site 3. router:LAN 172.22.140.254 into my DC: 172.22.140.1
Site 4. router:LAN 172.24.140.254 into my DC: 172.24.140.1
Site 5. router:LAN 172.23.140.254 into my DC: 172.23.140.1
WAN 2xx.xxx.xxx.xxx ? 2xx.xxx.xxx.xxx
Site 5s circuit only comes in on one Ethernet circuit so I don't know how to configure my router to the sonicwall without adding another complete circuit for the firewall.
Does this make any sense? HELP
email me for more info if needed. mervt@polarnet.ca

5 replies

by smeogul

like most security issues I wonder if this should be answered on a public forum. so I guess my first question is... are you hiring :)

this can be done and I can send the appropriate visio drawings for you as required. as long as you are not looking at vpn connections you should be fine with one uplink per site, the physical links are not really the same as logical links... the routing should be configurable as rules on the firewall.

by whatme?

I could be hiring. The contractor I have now hasn't responded to my calls in over 2 weeks. (don't think he knows what he is doing.)
No VPN connections. but I do have to access an internal sql server. I was going to place it in the dmz.

by smeogul

cool, keep me posted.
The sql server shouldn't be a big problem depending on what and how you need access, shouldn't really be an issue.

are you really in Nunavut? dying for an excuse to go up there :)

Like I said I would hate to post your security infrastructure here.

you should be able to put the firewall in front of or behind the router as long as you don't require vpn connections. (Depends really on your isp to some extent. is it their router or yours? what type of connections doyou have? (isdn, dsl, T1, frame?) that would disable the port for any but vpn traffic.

what are you using for server os on the networks? (assuming w2k since dc and gc but... 2003?)
what are you using for routers on the subnets?

cheers.

This discussion is closed to new replies.