Networks

Ask something
Discussion Locked

When would you put something in the DMZ

0 helpful
7 replies

by ronnonf 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a client that is hosting their site and soon to host others. They use FTp and the Web server is multihomed (i know security risk 101, but I didn't set it up) and communicates with a SQL server on the inside.
I have been going back and forthon this topic with a friend, the topic being when you would put a server in the DMZ and when you would map ports through the firewall.

7 replies

by cg it

Personally, I would put a Web, FTP on a DMZ when, a. The type of site poses a great risk of malicious attacking and therefore seperating such a site from the internal network is necessary for security. I didn't care if the DMZ web/FTP server got hacked into or a bug got into it. [the web site[s] and/or FTP site[s]info is readily and easily recreated,].

by cg it

Two senarios: If the type of site poses a great risk of malicious attack, then I would put a server on the DMZ [including SQL] seperate from the Domain network. Updates to Web, FTP and SQL are periodically done manually [not real time updating from the company network].

If real time SQL data is required by remote company users like salesmen, then I wouldnt have SQL on a DMZ. To much risk for malicous attack.

by ewgny

A possible solution for you, is to use an ISA server, using the web publishing feature.
You could keep your web server on the internal network and have the ISA server with one NIC on the internal Network, and the other NIC on the DMZ. Forward Port 80 from the firewall to the ISA server via the DMZ. The ISA server retrieves the info from the web server on the internal network, and sends it back out. I had a setup like this for over a year with no problems, and will most likely return to it. (Visit isaserver.org). This solution could solve your problem since you won't have to worry about your SQL server.

This discussion is closed to new replies.