Re: DMZ Ideas

[Carric Dooley <carric () com2usa com>]

I am assuming this puts the tags into some sort of database.. if so, I 
would have the 802.11 (the Symbol frequency hopping stuff, btw, is 
invisible to tools like Kismet) access points in a front-end DMZ with it's 
required data access components in a back-end DMZ. This segments the 
untrusted wireless network from your internal network, and provides access 
control TO the server/s required. Pull the data back into the network to 
sync with another database if required. Keep the rule of "don't allow 
untrusted nets to initiate connection to trusted" in mind, and u b aight. 
=)

On Thu, 30 Sep 2004 firewalladmin () bellsouth net wrote:

> Hi All:
>
> I am looking for some unique suggestions for a sitaution developing here at my place of employment. A contractor is 
> being hired to set up some wireless stuff for RF tagging (bar code tracking stuff for shipping/receiving). They will 
> be placing readers that send data to Wireless Access Points, which then need to terminate in a DMZ of some sort 
> before it enters the LAN. We will require them to use encryption and MAC filtering along with the appropriate 
> measures to secure the distance/range of the wireless signal to within the confines of the compound. My question is 
> this - What would make a good DMZ for this setup? We have a few suggestions up in the air and it's all prliminary 
> stuff right now. Some ideas are VLAN's (in my opinion too much management overhead, room for error and not 
> necessarily very secure), seperate subnet on router, etc. The tough part is what do we filter the traffic by? There 
> is no "user" to authenticate, only unmanaged readers/devices. The site is the s!
ize
>   of a big college campus, so separating the devices onto a seperate backbone/subnet will be physically difficult and 
> expensive as well. All suggestions are appreciated. Thanks,
>
> Mark
>
> Mark F.
> MCP, CCNA
> "You can spend your life any way you want... But you can only spend it once."
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () honor icsalabs com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

-- 
Carric Dooley
COM2:Interactive Media
http://www.com2usa.com


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards