I'm a little unsure about how our servers are configured on our DMZ and I want to know if our setup is the best practice or if I'm doing it completely wrong.
We have 3 servers on our DMZ - 2 IIS/webservers, and 1 front end Exchange server. Each server has two NIC cards on them.
One of the NIC cards has an IP address on the DMZ IP space with a default gateway pointing to the DMZ interface of our PIX so that traffic can get back out. The other NIC card has an IP address on our internal network IP space so that it can talk with our domain, and it's directly connected to a switch on the inside network completely bypassing the PIX. This NIC card has no default gateway specified because Windows 2003 server doesn't like it when you have two NIC cards with two different default gateways.
Is this a bad configuration or is this somewhat normal? Thanks for any advice.
The term is being multi-homed. It's not just Windows 2003, you can't have 2 default gateways period. I would consider it bad security practice. For example, if someone would somehow take control of your dmz machine, they would have direct access to your inside bypassing pix.
That is not the way that DMZ is usually done. Part of the normal rationale for DMZ is that devices go into the DMZ which are open to the public. The DMZ allows connectivity from outside and limits connectivity to inside. Therefore if one of the servers in the DMZ is comromised it does not allow the attacker direct access to the inside network. What you are doing in your situation is to provide direct and unprotected access to the inside network.
From a security perspective I would say it was not a good config.
Then how do I give the servers in the DMZ access to servers on the inside network? The developers keep telling me that their web apps need to be able to access the domain for the SQL server connections, etc..
Hi everyone, I would like to thank you in advance for any help you can provide a newcomer like myself!
Im studying the 100-105 book by Odom and am currently on the topic of Port security. I purchased a used 2960 and I'm trying to follow a...
While deploying a number of 18xx/2802/3802 model access points (APs), which run AP-COS as their operating platform. It can be observed on some occasions that while many of their access points were able to join the fabric WLC withou...
I am going to design and build an LAN network under a tunnel underground with long distance between the switches.
I will have 2 Catalyst switches and 8 Industrial IE3000, and they will be connected with fiber.
For now I am planning on use Layer-2 s...