I am working with 2 pix firewalls, and I am hoping to change
FW-2 to a different brand that has stateful inspection.
Are you saying that you don't think the PIX is stateful? I'm
absolutely certain that it is.
However, you are correct that the only way to make this sort of
two-firewall design more secure than a single-firewall design (with
three interfaces: Internet, LAN and DMZ) is to use different products
for the two firewalls so the defects of one are not duplicated by
the other.
One of my questions is the DMZ is in a /24 subnet and the LAN
is on a /16 subnet. Is the only way for the web server in the
DMZ to communicate with the inside LAN by NATting in the
FW-2. Isn't this creating a double subnet from the outside??
No. Assuming that these are public addresses, the /16 is broadcast
as a summary route, and the /24 is only visible locally. (I strongly
suspect, however, that if you're using a /16, it's probably on a
private (RFC1918) range, and so will not be advertised at all.)
David Gillett
-----Original Message-----
From: listbounce@securityfocus.com
[mailto:listbounce@securityfocus.com] On Behalf Of hol64@hotmail.com
Sent: Friday, October 26, 2007 8:41 AM
To: security-basics@securityfocus.com
Subject: DMZ - Question
I have to setup a DMZ on our network. Our current layout is
Internet Router <--> Firewall <--> WAN/LAN Router <--> Servers
The idea is to setup a back-to-back DMZ or Dual Firewall DMZ.
So the topology would be like this..
Internet Router --> FW-1 <--> DMZ <--> FW-2 <--> WAN/LAN router.
On the DMZ we will have a Web Server that needs access back
to the Mainframe on the LAN, and a Mail server that need
access to another mail server on the LAN.
One of my questions is the DMZ is in a /24 subnet and the LAN
is on a /16 subnet. Is the only way for the web server in the
DMZ to communicate with the inside LAN by NATting in the
FW-2. Isn't this creating a double subnet from the outside??
I am working with 2 pix firewalls, and I am hoping to change
FW-2 to a different brand that has stateful inspection.
Please Advice,
Thanks,
Pablo
