Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers

Servers in DMZ- Webserver (Company Website), Proxy

Servers in the internal Network - Messaging (Exchange) and Authentication and Domain Services (AD)

Now I have only one SAN setup which I should share between those two networks.

Is connecting the SAN to both the servers in the DMZ and the internal Network a Sin in Network Security Context ?

Whats the best practice ?

share|improve this question
up vote 2 down vote accepted

Since the SAN is a separate infrastructure, as long as you zone separate LUNs to separate locations, it should not be a horrible problem.

However, usually a SAN is the placeholder for all the sensitive data in the organization, and it is best to keep it as secure as possible, preferrably accessible only internally, by firewall protected servers

share|improve this answer

You don't mention what type of SAN you're thinking of, certainly I'd be a lot happier using an FC-attached SAN between systems in two different security zones as an intruder would have to hack the IP aspect of your web server, then hack an FC array - two totally different skills/protocols etc. - to get at the internal data. Also FC networks tend to be based around effectively point-to-point connections unlike 'regular' IP networks where things are open to all unless tied down. Conversely if you can crack a web server then you probably have the skills to go poking around over iSCSI, even if it's on a dedicated subnet.

share|improve this answer
Ok so, is it possible to have the SAN storage and the servers (which will use the SAN storage) in a different subnet i.e route the iSCSI traffic through a router ? – Vivek Bernard Mar 7 '11 at 14:35
It's all possible, none of this is hard, you just need to look at your security requirements and figure out how important that security is. If security is paramount then it'd be worth splitting out the storage completely, if it's of less concern then perhaps simply putting into two/four interfaces from your SAn box might make sense (i.e. 1 or 2 physical links going to DMZ/web and 1/2 links going to internal/app layer). – Chopper3 Mar 7 '11 at 14:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.