Management wise it would make it easier... you wouldn't be punching
several holes through two firewalls... Moving it behind the fortigate
would give you only one FW to make changes to. It would also give you
a better standard since most of the Networks I have worked on have had
their Public DMZ hanging off of a perimeter FW only allowing the
specific services necessary. It would still allow your IPS to do its
thing also.
HTH
John
On 5/2/06, Angel Alonso Párrizas <parrizas@gmail.com> wrote:
Hello all:
I need your advice about a firewall configuration with two levels of them.
In our organization we have a first level of FWs, fortigate 800, that mainly
are working such IPS (it is configurated is stealth mode, like a bridge).
In the second one, there is a FW1 separating the differents DMZ zones. There
are 3 DMZ behind the FW1 which manage the traffic between them and with the
outside (Internet). Also the FW1 does NAT.
There is one DMZ zone with a very high (1) level of security, and other one
with a medium level (2) of security and the third is a public DMZ with all the
public services like WEB servers.
OUTSIDE
|
fortigate (IPS in stealth mode)
|
PUBLIC DMZ ..... FW1-----DMZ (2)
|
..DMZ(1)
I would like to know if it is a good configuration to move the DMZ Public
to a fortigate Interface, and to make the NAT in the first FW fortigate for
the hosts in public DMZ. So the configuration will be:
OUTSIDE
|
fortigat -----Public DMZ
|
FW1-----DMZ (2)
|
...DMZ(1)
Which topology will you do with two levels of firewalls?
Thanks in advance.
--
Angel Alonso Párrizas
parrizas@gmail.com
CCNA, SSP-MPA
___________________________________
"La libertad no es algo negociable"
--
-----
Fight back spam! Download the Blue Frog.
http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1
