Home page logo
/

basics logo Security Basics mailing list archives

RE: DMZ - Question
From: "David Gillett" <gillettdavid () fhda edu>
Date: Fri, 26 Oct 2007 11:51:21 -0700

I am working with 2 pix firewalls, and I am hoping to change 
FW-2 to a different brand that has stateful inspection.

  Are you saying that you don't think the PIX is stateful?  I'm
absolutely certain that it is.
  However, you are correct that the only way to make this sort of
two-firewall design more secure than a single-firewall design (with
three interfaces: Internet, LAN and DMZ) is to use different products
for the two firewalls so the defects of one are not duplicated by 
the other.

One of my questions is the DMZ is in a /24 subnet and the LAN 
is on a /16 subnet. Is the only way for the web server in the 
DMZ to communicate with the inside LAN by NATting in the 
FW-2. Isn't this creating a double subnet from the outside??

  No.  Assuming that these are public addresses, the /16 is broadcast
as a summary route, and the /24 is only visible locally.  (I strongly
suspect, however, that if you're using a /16, it's probably on a 
private (RFC1918) range, and so will not be advertised at all.)

David Gillett


-----Original Message-----
From: listbounce () securityfocus com 
[mailto:listbounce () securityfocus com] On Behalf Of hol64 () hotmail com
Sent: Friday, October 26, 2007 8:41 AM
To: security-basics () securityfocus com
Subject: DMZ - Question

I have to setup a DMZ on our network. Our current layout is 
Internet Router <--> Firewall <--> WAN/LAN Router <--> Servers

The idea is to setup a back-to-back DMZ or Dual Firewall DMZ. 
So the topology would be like this..
Internet Router --> FW-1 <--> DMZ <--> FW-2 <--> WAN/LAN router. 

On the DMZ we will have a Web Server that needs access back 
to the Mainframe on the LAN, and a Mail server that need 
access to another mail server on the LAN.

One of my questions is the DMZ is in a /24 subnet and the LAN 
is on a /16 subnet. Is the only way for the web server in the 
DMZ to communicate with the inside LAN by NATting in the 
FW-2. Isn't this creating a double subnet from the outside??

I am working with 2 pix firewalls, and I am hoping to change 
FW-2 to a different brand that has stateful inspection.
 

Please Advice,

Thanks, 

Pablo



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]