F5 and PIX for webserver

jliscano · ‎05-24-2006

I had a question regarding securing our webservers that use IIS. We have 2 options in play. Which one is a better solution to secure IIS from the IIS vulnerabilities and etc...? I know both have advantages and disadvantages.

Here's the setup, a Cisco PIX firewall and an F5 connected to the DMZ in the PIX. The F5 has 2 VLANS:1.1 and 1.2. VLAN 1.1 has an public IP (example: 2.2.2.2) and VLAN 1.2 has (192.168.0.1)

1) place the IIS server in the internal network (10.0.0.0) and have the F5 communicate to it to retreive the pages for Internet users. The Internet users will see a public IP address but obviously the F5 will translate that to the internal IP address in the 10.0.0.0 network. Also, the server needs to communicate to a database on the internal network.

2) place the IIS server in the F5 VLAN 1.2 network (192.168.0.0) and have F5 communicate to it that way. The server then needs to communicate to the internal network (10.0.0.0) to access a database. Obviously we need to create open ports on the PIX at that point.

Hopefully i made sense.

Jerome

a.kiprawih · ‎05-24-2006

Hi,

Personally, I think Option #2 looks better for more secure access.

This is similar to the concept of hosting your public webserver in semi-trusted segment. Obviously, you do not want outsider to access your internal network directly in the event if someone managed to find way to hack into the webserver. If this happened, he/she is already on your secure network segment and had a greater chance to compromise other servers. DMZ is more or less act like a 'transit area'. Another layer of ACLs for DMZ and Inside interfaces will help to prevent/minimize the risks. And of course, an IPS will be a bonus to further inspect the passing traffic, especialy when firewall has no ability to check hidden/tunneling traffic.

Rgds,

AK

sgramm · ‎06-07-2006

I am haveing problems getting into the device manager of my pix. It keeps saying access denied. Where in the cli do you setup access to the https server

jliscano · ‎06-07-2006

First you want to enable "http server enable" on the PIX. Then add your station IP address with this command "http 255.255.255.255 inside.

You should then be able to https into your PIX via web.