RE: DMZ - Question

["David Gillett" <gillettdavid () fhda edu>]

> I am working with 2 pix firewalls, and I am hoping to change 
> FW-2 to a different brand that has stateful inspection.

  Are you saying that you don't think the PIX is stateful?  I'm
absolutely certain that it is.
  However, you are correct that the only way to make this sort of
two-firewall design more secure than a single-firewall design (with
three interfaces: Internet, LAN and DMZ) is to use different products
for the two firewalls so the defects of one are not duplicated by 
the other.

> One of my questions is the DMZ is in a /24 subnet and the LAN 
> is on a /16 subnet. Is the only way for the web server in the 
> DMZ to communicate with the inside LAN by NATting in the 
> FW-2. Isn't this creating a double subnet from the outside??

  No.  Assuming that these are public addresses, the /16 is broadcast
as a summary route, and the /24 is only visible locally.  (I strongly
suspect, however, that if you're using a /16, it's probably on a 
private (RFC1918) range, and so will not be advertised at all.)

David Gillett


> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of hol64 () hotmail com
> Sent: Friday, October 26, 2007 8:41 AM
> To: security-basics () securityfocus com
> Subject: DMZ - Question
>
> I have to setup a DMZ on our network. Our current layout is 
> Internet Router <--> Firewall <--> WAN/LAN Router <--> Servers
>
> The idea is to setup a back-to-back DMZ or Dual Firewall DMZ. 
> So the topology would be like this..
> Internet Router --> FW-1 <--> DMZ <--> FW-2 <--> WAN/LAN router. 
>
> On the DMZ we will have a Web Server that needs access back 
> to the Mainframe on the LAN, and a Mail server that need 
> access to another mail server on the LAN.
>
> One of my questions is the DMZ is in a /24 subnet and the LAN 
> is on a /16 subnet. Is the only way for the web server in the 
> DMZ to communicate with the inside LAN by NATting in the 
> FW-2. Isn't this creating a double subnet from the outside??
>
> I am working with 2 pix firewalls, and I am hoping to change 
> FW-2 to a different brand that has stateful inspection.
>  
>
> Please Advice,
>
> Thanks, 
>
> Pablo