RE: DMZ best practices

["Andreas Haug" <ajh () this net>]

Someone, Bill_Royds () pch gc ca or John Kozubik (I'm not sure) wrote:

> The segment behind a third NIC that carries servers that one runs but may
> not trust (because they are open to public) could be called the
> dirty segment. or server segment. Vendors call it the DMZ because early
> firewalls with only 2 nics put servers on the true DMZ.

I strongly protest against calling firewalls (ALFs) with only two nics
"early firewalls". You can get away with calling non-multistaged firewalls
"early firewalls", but we would need to define the term multistaged firewall
first.

Relating to the whole 2-or-3-nics question, I would like to ask this group
of wizards for comments on the following:

Acronyms:

        IN      Internet
        Ex      Firewall Entity x
        CN      Corporate Network (protection needed)
        WS      Webserver
        X       some other "firewall" or not
        (other servers ommited)

Setup A:

      IN <----> E1 <----> E2 <-----> X <---> CN
                          !
                          WS


        The Web server is located on a "dirty" network


Setup B:

      IN <----> E1 <-+--> E2 <-----> X <---> CN
                     !
                     WS

        The Web server is located in the first DMZ

Consider this:

(1) I am trying to make the WS resist against attacks below layer 7 (land,
boink, teardrop, ...)
(1b) If (1) does not hold, there is a chance that the "new" attack works
against E2, too.
(2) E2 is not able to prevent every attack at layer 7 and above
(3) E2 is put at risk by the traffic flowing through it (buffer overflow in
proxy)

> One does need a segment that allows servers to be protected by direct
> attacks but would also be restricted in access to internal use.

How about: Compare the risk of loosing the web server to the risk of having
a firewall broken?

Regards,

andreas.
--
Work: http://www.helupie.de  haug () helupie de  phone +49 6081 9162-60 fax -80
Home: http://www.this.net    me () this net      phone +49 7127 9724-54 fax -54
Note: Views expressed above might not reflect those of the people who pay me