|
Posted by Leythos on March 1, 2005, 6:15 pm
If you were Registered and logged in, you could reply and use other advanced thread options
On Tue, 01 Mar 2005 09:58:02 -0800, wfsmith wrote:
> I have 2 applications servers and one DC/SQL server at a colocation
> facility that server as a public web server cluster. I am using a
> Watchguard Firebox X 1000 currently and a VLAN segmented Cisco Catalyst
> 2950 router. I am looking to redo my network setup to make it safer,
> given that ive learned a bit more about network security since I first
> set this up.
>
> Any one out there feel like reading this and posting your suggestions,
> as little or much as you want, id appreciate it!
>
> My current setup is this:
>
> Firewall (Firebox X 1000)
> |
> Switch (Cicso Catalyst 2950)
> | |
> DMZ TRUSTED
When we setup secure webservers and database servers as the back-end we do
it as follows:
INTERNET
|
Firebox 1000
|LAN | DMZ
| \ WEB 1
| WEB 2
\ SQL 1
You do not use domains/ad on the servers, you don't need it to run as a
web server and you certainly don't want to use Windows authentication
between the Web servers and the SQL server.
Yes, you need to open 1433 from DMZ to LAN for the web servers to access
the SQL server.
The web servers can get their DNS from the ISP's DNS server. You might
make a static host file entry if you want to use the SQL servers name
instead of IP.
The SQL Server, if it needs to contact the web servers from it's side will
need DNS installed, you can make the SQL server a DC, but don't make it in
the same domain as the web servers - this is a security risk. Set the SQL
server to use mixed mode - so that your web application passes a
user/password in order to connect. DO NOT USE THE SA ACCOUNT.
Now, if you want to manage everything remotely, you need to setup simple
PPTP VPN to the Firewall, then create an ANY rule that permits PPTP to
access both DMZ and LAN subnets.
You could create an ANY rule that lets the LAN reach the DMZ, but don't
open anything from DMZ to LAN except for 1433.
I would set the LAN to 192.168.10.0/24
I would set the DMZ to 192.168.11.0/24
> So what do you all think? I would love some help/feedback with this
> idea. I am also looking for someone to help me over the next few
> weeks as I try to implement this with a production environment.
> Looking for a guru, will pay of course. Thanks in advance for reading
> this far and/or responding with your opinions, suggestions and vast
> security knowledge.
If you end up with the LAN being your company network, you can have the
SQL server be part of the company Domain/AD, but DO NOT MAKE THE WEB
SERVERS PART OF IT - use your web application to authenticate with the web
server via SQL User accounts, not SA or Windows accounts.
We setup this config all over the US, you don't have to pay for help if
you keep it in Usenet or email, I like to give back for all that I
learned/learn on Usenet.
--
spam999free@rrohio.com
remove 999 in order to email me
| 
XML site map