Shared DMZ

[laitounejjar]

Hello everyone and sorry my english.
We have bought a hardware FW and we have a second WAN connection. So we decide to review our network architecture.
My idea is shown on attached image (for details : (i) this way i can redirect some client to ISP2 directly. (2) My domain is publicly declared as a.b.c.d).

What do you think about the idea ?
What about the public servers in dmz (they have initially one gateway 192.168.0.1) ?
have you a better idea ?

Thanks.

[icecream-guy]

what is R-Cisco?

I would suggest to move the ISP-2 connection over to the hardware firewall, so there is only one entry/exit to your network, no backdoor.

[laitounejjar]

Thanks for your reply.
Yes its a possible idea. R-cisco = Router cisco.
What about icoming connection from a.b.c.d (ips2) to servers in dmz who is shared between isp1 and isp2 (with a fail over)?

[config t]

What about icoming connection from a.b.c.d (ips2) to servers in dmz who is shared between isp1 and isp2 (with a fail over)?

i'm not sure i am understanding this correctly. are you saying you want to move the isp2 connection to the dmz? that would make it no longer a dmz.

Agreed with ristau.. only one entry/exit. otherwise you don't have an effective boundary.

[Dieselboy]

1. When traffic arrive at R-Cisco for a DMZ server, it may not go via the firewall.

It will go: Internet -> R-Cisco -> DMZ server.

2. When the DMZ server reply to the internet, it will use the default gateway (firewall):

DMZ Server -> Firewall -> R-Cisco -> internet

Note A) Depending on the firewall, the security on your firewall may break this traffic by default because the reply from the DMZ server is not a TCP SYN packet


The diagram is too complex for the simple network. My suggestion is to have: Internet > R-Cisco > firewall > DMZ.

R-Cisco role = route between internet <-> firewall

Firewall role = Route between internet <-> DMZ

Note B) Failover for DMZ server may not work with your current design.

My final suggestion to you:

I suggest that you test all of the components of your design like auto-failover and see if you have any problems (or not) and work through those.

[deanwebb]

Hello, I am the attacker. I like the R-Cisco thing. When can I set up an appointment to compromise your network? I have some availability next Thursday morning.

Also, having asymmetric paths can often break applications.

[wintermute000]

Why not just run both WAN links off the FW and use the FW to do the appropriate load balancing, whether via routing or PBR or other $VENDOR features.