Hi All,
Since there's no mention of the Internet bandwidth provided or any
detailed info on incoming/outgoing traffic, I'd like to raise the point
that bandwidth traffic should be a consideration when designing the
security infrastructure as well as the traffic volume capability of the
FWs. After all, it would not be good if the FW becomes a chokepoint for
the incoming/outgoing traffic instead...:-)
Cheers,
Jordan Wang
Angel Alonso Párrizas wrote:
Hello all:
I need your advice about a firewall configuration with two levels of them.
In our organization we have a first level of FWs, fortigate 800, that
mainly are working such IPS (it is configurated is stealth mode, like
a bridge).
In the second one, there is a FW1 separating the differents DMZ zones.
There are 3 DMZ behind the FW1 which manage the traffic between them
and with the outside (Internet). Also the FW1 does NAT.
There is one DMZ zone with a very high (1) level of security, and
other one with a medium level (2) of security and the third is a
public DMZ with all the public services like WEB servers.
OUTSIDE
|
fortigate (IPS in stealth mode)
|
PUBLIC DMZ ..... FW1-----DMZ (2)
|
..DMZ(1)
I would like to know if it is a good configuration to move the DMZ
Public to a fortigate Interface, and to make the NAT in the first FW
fortigate for the hosts in public DMZ. So the configuration will be:
OUTSIDE
|
fortigat -----Public DMZ
|
FW1-----DMZ (2)
|
...DMZ(1)
Which topology will you do with two levels of firewalls?
Thanks in advance.
--
Angel Alonso Párrizas
parrizas@gmail.com <mailto:parrizas@gmail.com>
CCNA, SSP-MPA
___________________________________
"La libertad no es algo negociable"
