Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are planning on setting up a network similar to the following

Network Diagram

Can anybody comment/criticize on the placement of the proxy server in this particular diagram and possibly suggest alternatives.

The end users must go through the proxy to surf the web, yet must be able to access all the internal resources (file servers etc) without the proxies help.

EDIT :

I realize that the network above is crap at best ! anyway I didn't expect that to win any awards :)

So here is a revised version of the network diagram based on the comments and answers.

New N/W Diagram

Questions

(Please assume this to be a fairly large corporate network)

1) Where should I place the "internal servers"(by that I mean the Directory services and the Messaging servers)?

-Should they be in the DMZ or should they be in the internal network?

2) If they must be in the internal N/W, how can it establish site-to-site connections (AD for example)?

3) Is the Proxy server placed at the correct place?

4) Is it of any use having the IPS devices shown above ?

share|improve this question
2  
What problem are you trying to solve? –  Joel K Jan 27 '11 at 8:20
    
I would be under the impression that the Proxy would be somewhere between the Router "R1" and the firewall...what's the blue box with a circle and two arrows? –  tombull89 Jan 27 '11 at 9:48
4  
@tombull89 - it's a london underground station (I think) –  Chopper3 Jan 27 '11 at 10:09
    
@Chopper3, nice, but there needs to be some red in there as well. –  tombull89 Jan 27 '11 at 10:11
    
@tombull89 - isn't it Colourblind Street? –  Chopper3 Jan 27 '11 at 10:18

3 Answers 3

Exactly how you go about this does depend to some degree on the size of your network but what you're asking for is not too dissimilar to how I have things structured at both work and home, so I'll describe those.

The firewall (I use Smoothwall) has 3 NICs. The third provides a DMZ, which is where the Internet facing servers go. The firewall has a built-in proxy, so satisfies that functionality for the machines on the internal network. Routing between the internal network and both the DMZ and Internet is also handled by the firewall.

The only thing I would point out is that to use Smoothwall effectively as a proxy the machine needs to have a reasonable amount of RAM, as that is where the proxy cache is held.

share|improve this answer
    
thanks and sorry for changing the question's scope quite a bit. I did it because I realized that the proxy was not the only thing that was wrongly placed. –  Vivek Bernard Jan 29 '11 at 16:46

If your users MUST go through the proxy to access the web then simply remove any physical route to the external network from direct connection to the LAN and use the proxy server as the LAN's only internet gateway.

Anything else leaves the potential for someone to get around the proxy server. In terms of your diagram then, I'd move the proxy so its connected between the router R1 and the firewall.

I realise this would mean some extra work configuring the connection between the servers and the internet so they are not filtered but if when you say the connection must be filtered for the users you really do mean that it really must with no possible exceptions or workarounds then I reckon you have little choice.

We do this using ISA Server/Forefront TMG as we're mainly a Microsoft shop, and it actually works really well.

Update Based on your recent edit and new diagram

1) Where should I place the "internal servers"(by that I mean the Directory services and the Messaging servers)?

-Should they be in the DMZ or should they be in the internal network?

I would place them on the internal network, e.g. behind the content filtering proxy.

It removes layers of complexity between them and their clients, and gives you an opportunity to content filter messaging content should you wish.

2) If they must be in the internal N/W, how can it establish site-to-site connections (AD for example)?

Not sure what you mean here? Site connections to what? In any case, I don't see a change here - to go between physical sites across (say) the internet then you can use a VPN, which is how you presumably would have done it before?

3) Is the Proxy server placed at the correct place?

In my opinion, yes - your new proposal is essentially what we do (we use back to back firewall config with the LAN filtered by Forefront TMG which does proxying as well as firewalling) and reflects what I suggested in my original version of this reply.

Beyond that, does it feel right to you? Do you think it achieves what you hope to achieve - there are lots of "correct" ways to design a network but in my opinion the "best" way is less about using any particular technology or methodology and more about creating a set-up that's appropriate for the budget, the level of service required and one that makes sense to the people who have to support it.

4) Is it of any use having the IPS devices shown above ?

Whether its worth having them at all is arguably a whole different question; getting good use out of IPS is arguably a specialist subject all on its own. Putting that aside for now, you've put them in what I think are reasonable places.

share|improve this answer
    
Thank you so much for your time ! Let me rephrase Q2) When a AD domain spans multiple sites eg two locations connected over the wan. Where should I place the AD servers, or connecting them via VPN links are the only way to go? What I thought was, for the AD server to communicate with the other server (which is located across a wan), may be I could place that (AD server) in the DMZ as well ? Whats the industry practice? –  Vivek Bernard Jan 29 '11 at 16:34
    
@Vivek - security "best practice" would be to keep DCs as far away from your Internet connection as possible. As such, you would want to set up a site to site VPN and use that to extend the whole LAN (rather than just creating a VPN on each DC). You'd need routing between the two physical sites and you would want to create an additional AD site for the remote network (again best practice says you want a DC at the remote site too) –  RobM Jan 29 '11 at 19:19

Couple of comments: A proxy does not need 2 NICs necessarily. As long as your firewall rules prevent your internal hosts accessing resources externally, then they'll have to go via the proxy (which you might set up via Group Policy for example in a windows network) . This will mean the proxy is easier to deal with in a failure, too.

Also, your "IPS" boxes - they need only be symbolic, as a good firewall should be able to IPS for you, and will cover whichever interfaces you need. IPS aren't usually that great against internal threats though - so you might only want to IPS on the internet facing interface.

share|improve this answer
    
thanks for the comments, Just on doubt on your comment on the proxy. won't it be a bottle neck to have incoming and outgoing connections through the same interface. Please don't think that I'm arguing, I really don't know. –  Vivek Bernard Jan 29 '11 at 16:38
    
Not in my experience - modern NICs operate in full duplex, and other components would sooner become a bottleneck, eg the cpu or hd in the proxy, especially if its a gigabit nic! –  Tom Newton Jan 30 '11 at 15:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.