Re: External Network / Firewall Setup.

["Ivan ." <ivanhec () gmail com>]

Pete,

> I'm wary of a single point of failure.  
Everything you listed in your diagram is a single point of failure? If
you want redundancy you would start at the router, make it a HA pair,
2 switches, the FW a HA pair, 2 switches and the last FW a HA pair and
2 more switches. Sorry, I couldn't be bother doing a ascii diag for
you.
If you go the PIX route the second in a HA pair is half price. Also
take a look at Netscreen's, good value.

> Should I use the DMZ mailserver simply as a relay for an internal mailserver?
yes, for sure

contact me off list if you want a quick and dirty diag

cheers
Ivan

On 9/5/05, lists () ninjafriendly com <lists () ninjafriendly com> wrote:
> Hi all,
>
> Background: We're a .sch.uk with a currently county-managed firewall and webmail
> provision.  We have a 2mb symmettric DSL connection with approx 30% use at any
> one time.  Due to service and reliability issues with the county-managed
> solution we are looking to run our own mailserver, accessible from the
> internet.  On balance, maintaining our own firewall setup is less hassle than
> keeping what we currently have.
>
> I'm currently in the process of working out the firewall requirements, what I
> have so far is this:
>
> Internet
> |
> Router
> |
> Firewall(1)
> |
> HUB---Snort(1)
> | |___Mailserver
> |
> Firewall(2)
> |
> HUB---Snort(2)
> |
> |
> LAN
>
> I suspect this setup may be overkill for the amount of traffic we receive, but
> I'm wary of a single point of failure.  Hardware isn't a problem.
>
> Further info: The mailserver will be running Horde.  I'm hoping to convince
> management to use a PIX or similar for the first firewall and then something
> *nix based for the second, otherwise it will be two *nix boxes (IPcop and
> something BSD based).
>
> Something I'm still unsure about is internal clients connecting to the
> mailserver in the DMZ - how much of a security issue is this?  Should I use the
> DMZ mailserver simply as a relay for an internal mailserver?
>
> Would anyone mind looking this over and telling me if I've screwed up /
> overlooked something?
>
> Thanks
>
> Pete