In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes ...

learn more… | top users | synonyms

0
votes
2answers
917 views

How to share a SAN(Storage Area Network) Environment between servers in DMZ and a internal Network?

My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers Servers in DMZ- Webserver (Company Website), Proxy Servers in the internal Network - Messaging ...
4
votes
3answers
3k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
0
votes
1answer
1k views

Sonicwall NSA 240, Configured for LAN and DMZ, X0 and X2 on same switch - ping issues

Our Sonicwall vendor supplied and networked the NSA240 when we required a DMZ in our infrastructure. This was configured and appeared correct although VPN users periodically dropped DNS and Terminal ...
0
votes
2answers
199 views

Network topology question

We currently have three networks, X.X.163.1, X.X.93.1 and 192.168.1.1. Today's setup is like this: http://i.stack.imgur.com/tkKWy.jpg We now have PPT VPN from internet to the X.X.163.1-network, but ...
2
votes
3answers
228 views

network topology including many services

I know this is yet another question on how to setup network but I hope you are not bored of such questions yet. The site is also an office, so it includes windows dc, windows ad, exchange, sql, file ...
1
vote
4answers
480 views

Putting a Windows DC, Exchange in a DMZ

I have one guy at my company telling me that I should put FF:TMG in between my main Internet-facing firewall (Cisco 5510) and put my Exchange server and DC on the internal network. I have another guy ...
0
votes
1answer
283 views

DMZ setup and firewall throughput limit

I am in the process of moving server room into the datacenter and it is a good time to review current setup for security zones.We are using Vsphere 4 Standard and Cisco ASA 5510 firewall. At the ...
1
vote
3answers
170 views

Securing VPN access from users machines (home office)

We already have a couple of people working from home, accessing some internal servers via VPN. They're all using company provided laptops or PCs which we have complete control over. Now we're faced ...
0
votes
1answer
197 views

Securing internal data accessed by a website on the big, bad internet

A close relative of this question on Stack Overflow: When you have a web site in your DMZ that needs to access production data stored on an internal DB, what strategies do you recommend using to ...
2
votes
5answers
1k views

SFTP: How to keep data out of the DMZ

We are investigating solutions to the following problem: We have external (Internet) users who need access to sensitive information. We could offer it to them via SFTP which would offer a secure ...
0
votes
2answers
369 views

Reverse Proxy - Can I use one IP for multiple hosts?

I would like to setup an internal box that all all external traffic gets forwarded to, and then onto the relevant boxes in-house. I would like to know the following: If I have two servers in-house, ...
1
vote
5answers
1k views

DMZ configuration and firewall throughput

I've been asked to look into placing a firewall between a webserver (Debian/Apache/PHP) in the DMZ and a backend MySQL database to achieve "isolation". Right now, iptables is running on the MySQL ...
-1
votes
1answer
137 views

is opening DNZ will cause security problem? [closed]

I build a home server with Xampp. When route my local ip addres with NAT there is virtual server and DNZ. If I only full fiel virtual server my http port not opens.if I enable DNZ then I can reach my ...
2
votes
1answer
471 views

What's the best method of achieving device isolation in a DMZ?

I have an ADSL connection which has a /29 subnet allocated to it, giving me 6 usable IP addresses. Currently this has a cheap Netgear ADSL router attached, which has a built in switch. There are 3 ...
4
votes
6answers
3k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
2
votes
1answer
685 views

Is it necessary to have DMZ machine or zone on a network?

Is it necessary to have DMZ machine or zone on a network? What reasons are there for having a DMZ machine or zone? If the DMZ zone cannot communicate with the normal network at a site, why have it?
1
vote
3answers
782 views

Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ?

I appreciate that to get a proper DMZ, one should have a physical separation between the DMZ servers and the LAN servers, with a firewall server in between. But, in a network consisting of a single ...
1
vote
1answer
244 views

Persistent TCP connection in DMZ

A vendor is requesting to allow persistent tcp (not port 80) connection between a server in the DMZ and the internal network. I don't have much experience with this setting. Can anyone shed some light ...
-1
votes
1answer
550 views

FTP in DMZ, TCP Ports for LDAP Auth

szenario: (outside)---(ASA5510)---(inside) ->Windows2008 DC .....................(dmz) ..........->Win2008 FTP Server Which Ports do I need to open from DMZ->Inside that FTP Users can ...
1
vote
3answers
1k views

Cisco Multi-DMZ firewall

I need to find a firewall that will give me 1 LAN port, and 5-7 DMZ ports. I have a requirement to replace some FreeBSD systems that are used to run some testing equipment. It is essential that the ...
6
votes
4answers
7k views

Should a webserver in the DMZ be allowed to access MSSQL in the LAN?

This should be a very basic question and I tried to research it and couldn't find a solid answer. Say you have a web server in the DMZ and a MSSQL server in the LAN. IMO, and what I've always ...
2
votes
2answers
191 views

Just LB or also Web Servers in Demilitarized Zone?

In a load balanced environment, is it necessary to have all of the web servers in the DMZ? Or will just having the Load Balancer in the DMZ achieve the desired security? If it matters, the web ...
1
vote
2answers
1k views

Proper Network Infastructure Setup DMZ, VPN, Routing Hardware Question

Greetings Server Fault Universe, So here's a quick background. Two weeks ago I started a new position as the systems administrator for an expanding health services company of just over 100 persons. ...
1
vote
4answers
2k views

ESX servers in a DMZ

I have two ESX 3.5 servers in a DMZ. I can access these servers on any port from my LAN via a VPN. Servers in the DMZ are unable to initiate connections back to the LAN, for obvious reasons. I have a ...
0
votes
1answer
95 views

New router messed up server 2003 setup

Hey, We were sent a new 2wire router today configured it as best we can to match the old bt voyager. We've also got X static IP's. We've manage to get our webserver on one of the new IP's public ...
1
vote
1answer
450 views

Virtual firewall in existing network DMZ?

A network configuration question from a relative newbie... We have an existing LAN setup, with a hardware firewall (D-Link DIR-655) and a Microsoft Small Business Server (which does the DHCP). We ...
1
vote
1answer
452 views

ISA Server: How to troubleshoot DHCP problem?

I've added a DHCP Server to my ISA Server. The purpose of the DHCP server is to provide addresses to a DMZ (on its own interface) for misc computers that need internet access but don't need to be part ...
1
vote
1answer
522 views

DMZ - LAN and Webserver

i know that DMZ should contain servers that acts as a middle point between the trusted area like LAN and the other semi or non trusted area like internet or another DMZ. based on this declaration our ...
1
vote
2answers
3k views

Cisco VPN Client dropping connection

Using Windows XP and Cisco VPN client version 5.0.4.xxx to connect to a remote customer site. We are able to establish the connection and start an RDP session, but within 1-2 minutes the connection ...
0
votes
2answers
183 views

Can I make VM's accessible over VPN, but not LAN?

In the near future, my firm will begin hosting Terminal Services systems for a few business customers. The Terminal Services Servers will be VM's on one of two large VM hosts. To provide secure ...
2
votes
4answers
5k views

If you need to open ports from DMZ to LAN, at what point is the separation no longer worth it?

If you have a DMZ with one or more servers/services (maybe FTP, HTTP en SMTP). And you have a LAN with typical serversservices (like file sharing, Active Directory, database server). Depending on ...
0
votes
1answer
501 views

IIS FTP - Users Last Logon

How would you determine the last FTP logon time/date for a bunch of local user accounts on a DMZ (standalone/workgroup) server running IIS FTP? I know I could use a log aggregator and sift through it ...
0
votes
1answer
871 views

How can I set up a DMZ for Wireless Access?

My company uses Microsoft Windows Server 2003. Our internet connection goes through a proxy server across a WLAN to the main office. I want to set up a wireless LAN in my local network whereby ...
0
votes
1answer
849 views

Juniper SSG5 Firewall

I have a SSG5 firewall with some route based VPN. I have a LAN, a DMZ, an another net and WAN. How should I do to make DMZ use VPN and not LAN? I think it's a routing problem. But Source routing ...
6
votes
2answers
2k views

Virtual host on LAN - VMs on DMZ, separate NICs - is this a bad idea?

Just kicking this idea around, and wanted to see if you'll be so kind as to point out the problems I don't see. If I set up this new HyperV host as a normal domain member, the benefits are obvious. ...
0
votes
2answers
235 views

Slow Routing Problem

I've got the following network: ADSL(10.) --- Router (10.0.0.50,172.0.0.1) --- "HTTPServer (172.0.0.10)" | | --- "HTTPS Server" (10.0.0.3) --- Another computer (10.0.0.5) I ...
2
votes
3answers
275 views

Webservers - Attached to AD or not?

Do you prefer to run their IIS webservers inside a DMZ that is part of the greater organisation's AD or do you prefer to sacrifice ease of management and user control over (possibly perceived) ...
3
votes
3answers
4k views

Active Directory Domain Controllers in a DMZ

I am looking to deploy 2 additional Windows Server 2003 domain controllers into a separate confidential DMZ alongside 6 DCs that are installed in the regular network, making a total of 8 DCs. The 2 ...
2
votes
7answers
3k views

Should databases containing customer information go in a DMZ?

We're deploying a simple newsletter webapp on a stand-alone LAMP platform in the company DMZ. There is some discussion as to whether the MySQL server should be removed from the DMZ and put in the ...
5
votes
3answers
5k views

Active Directory in a DMZ

What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local ...
3
votes
1answer
736 views

Will you allow NetBIOS into your DMZ?

Is it secure for a firewall to allow NetBIOS connections from the internal network to the DMZ? If not secure, what are the risks? If secure, what is the FUD about and what are the counterarguments? ...
1
vote
2answers
419 views

Considerations for Security appliance/software in DMZ

What are the significant considerations when designing and setting up a dmz for a relatively small office (15-20users) with a limited budget? The network traffic across the dmz will be inbound smtp ...