|
Posted by htredneck on April 16, 2005, 5:28 pm
If you were Registered and logged in, you could reply and use other advanced thread options
I'm not exactly following your question or diagram... I gather you
drew a logical diagram and not a physical diagram (you don't really
have 3 firewalls, do you?)
a service provider is going to "represent" your internal servers? I
don't follow here... I gather they are going to replace your internal
servers with different ones outside of your trusted network? e.g. bye
bye all internal servers, they all moved to the dmz?
Also, why are they all getting registered IP addresses if they don't
need to route over the internet... seems like a waste of "500" usable
IP addresses... Which leads to my next question... how big is your
company that you need 500 IP addresses? Not saying you don't need
them, but it seems like an awful lot... I would think a more
efficient plan of your services may be able to shave that number down
in most cases...
So, in short, is this what you want to accomplish:
all users now access trusted servers inside your network and it
works..
future plan is to move all of those servers (services) outside to the
DMZ for your internal users to access... but NOBODY will need to
access these services from the Internet...
You also lost me on the safety concern w/ ACLs at then end of your
last statement... All access to ANY service outside of your firewall
can be risky... this is why you have a qaulity firewall and you
employ someone who knows what they are doing to set it up. (even
after that is done, you can't assume your network is bullet proof)...
htredneck
wrote:
>Hi All,
>
> a project leader is proposing to represent all our _internal_
>servers in our internal network on the outside of our internal firewall
>in our dmz each with an unique officially obtained _public_ ip-address.
>The obtained subnet will not be routed over the internet. His main
>argument is that we are dealing on the other side of the dmz with a
>company that manages our office network that maintains it's own
>ip-address policy and that we must be able to switch to another office
>IT provider without changing ip-addresses.
>
> Besides that it will be difficult to obtain /22 public ip-
>addresses (we're talking about +- 500 servers), my opinion is that you
>don't do this, just because it's against common practice, which, as an
>argument, does not make an impression, as you can imagine and that
>this will not be inherently safe (failing of the acl on the outside
>firewall exposes the internal network).
>
> What other arguments are there against this proposal?
>
> What solutions are there that with a minimum of public addresses
>in the dmz, you can make 100-ths of internal servers available?
>
>Sincerely,
>
>Jan.
>
>PS For those who can't imagine the layout:
>
> internet
> |
> external firewall
> |
>external servers----------dmz------------|office providers firewall
> |
> internal firewall
> |
> internal servers
>
| 
XML site map