up vote 3 down vote favorite
share [g+] share [fb]

One of my clients asked me to check his network. In his server rack I found a Fortinet FortiGate 60 and a Zyxel Zywall 70. Both of them are - in my opinion - complete firewall solutions for SOHOs (which he is with 1 server and about 10 clients).

Since I'm not a network expert, I don't know if this setup can be useful or if it is just redundant.

link|improve this question
feedback

4 Answers

up vote 3 down vote accepted

With an single external connection such a configuration would be highly unusual.

Reasons I can think that why a second firewall could be used for a small group.

  1. For access into an intranet or extranet
  2. For business unit separation - i.e. finance cannot access auditing, possibly for legal reasons
  3. If there is remote access (VPN or dial-up modem) that is configured on the non-front facing firewall device. - Not sure this is necessary for such an environment, but possible
  4. External contractors boosting profit from overselling network appliances.
  5. The second firewall is used for offering extranet access to business partners. I doubt this small a setup is offering extranet access.

Good luck

link|improve this answer
Reason 4 is the most plausible, I think. All the other setups like remote access etc. can be handled by one firewall. – dwo Feb 10 '10 at 18:31
feedback
up vote 2 down vote

Two firewalls filtering the same LAN would sound wrong if they were back to back with no other network.

You need to check these firewalls and make a map of the network in order to be able to decide. Only this will give you the information you're looking for.

link|improve this answer
feedback
up vote 1 down vote

Only useful if they're run by different groups.

The only situation you'd run into such a setting is if you're at a big organization such as a large financial or government organization.

link|improve this answer
Just a quick note. With the virtual domains on the Fortigate there's no need for multiple firewalls even in the case of being run by different groups. But there may be other driving factors that require more than one unit. – 3dinfluence Feb 10 '10 at 15:42
They're different groups that don't trust each-other, not that have different administrative duties... – chris Feb 10 '10 at 16:37
Yes I understood that and Fortigate's support this. Controlling the administrative duties between admins/users within each virtual domain is also possible but is a different layer of access control. – 3dinfluence Feb 10 '10 at 21:47
feedback
up vote 0 down vote

Could it be that they are running as an Inner and Outer firewall... and then there could be a LAN switch inbetween running a DMZ.

Not how I'd design it nowadays, but some customers insist of two layers of firewalls from different vendors on the Inside/Outside of DMZ.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.