topic Re: DMZ or NAT for web server in General Topics

DMZ or NAT for web server

mdfaulkner — Thu, 05 Sep 2013 05:39:16 GMT

Hi there,

I'm looking for some insight on the best security design for several externally accessible web applications. We have several public IP addresses available and can simply do a 1:1 NAT for each web server, put it in a DMZ, or both. Each web server has an internal SQL database to complicate things. From a best security perspective i'm not sure if a 1:1 NAT will work fine or if i should use a DMZ. I would still like to allocate 1 public IP address per web server.

thx

Re: DMZ or NAT for web server

sraghunandan — Thu, 05 Sep 2013 06:34:57 GMT

You can have your servers in the DMZ zone and then do a 1:1 dnat for your servers. Something similar to the example given in page 15 of this doc https://live.paloaltonetworks.com/docs/DOC-1517

Re: DMZ or NAT for web server

VinceM — Thu, 05 Sep 2013 09:09:34 GMT

In my mind, the best security thing should be

- Using DMZ

- Using reverse Proxy in DMZ

- Install your server in an other zone

Concerning NAT, 1:1 nat is ok

Then allow access from outside to your DMZ. then open access from dmz to your web server.

Re: DMZ or NAT for web server

apasupulati — Thu, 05 Sep 2013 14:59:43 GMT

Hello,

You can do both, since these are externally accessible servers you can install them in a separate zone from your LAN and do static 1:1 NAT for public access to these servers. Then configure a policy to allow outside access to the webservers on DMZ (if needed restrict the services allowed for more security). Document suggested above is a good reference.

When you mention each server has an internal sql database, do they have to access internal production database on your LAN? However, you should be able to configure security policies accordingly for the servers to talk between zones.

Hope that helps!

Thanks,

Aditi

Re: DMZ or NAT for web server

mdfaulkner — Thu, 05 Sep 2013 16:33:54 GMT

basically, they are 3rd party applications with web interfaces. Currently, everything is on the LAN (web server and SQL server) but i'm implementing a new PA-3020 and may utilize a DMZ for the web server and keep the sql box on the LAN, and like you say, just have the DMZ zone and trust zone communicate. Thanks for the reply, i'm going to have a look at that document now.