dmz design

[simsim]

Hi,

What is the benefit of having DMZ setup with two firewalls. 

If we have dmz setup with two firewalls ( I don't know this design is valid and adopted design, I found it  in the net ) 

If this is a valid design ,From local lan how the traffic flow to outside  (10.0.10.0/24 to internet ) and outside the local lan 10.0.10.0/24

Thanks

[OtakarKlier]

Hello,

One thing is the amount of load on the firewall. With two youre splitting some of the traiffc off and the outer on is taking the brunt of the external attacks. In the modern world with next gen firewalls that are sized appropriatly, either design will work. I dont see a problem with the collapsed DMZ model, e.g. one firewall with dmz branched off.

As long as they are configured correctly :).

Just my thoughts,

[simsim]

Hi,

Thanks for the reply . If I need to design DMZ with two fw , could you please  give an sample toplogy and the data flow 

Thanks

[Mick_Ball]

Thats a bit difficult as it depends on what you are using the dmz for and what type of services are contained within it.

in a basic setup traffic from outside is only allowed access to the dmz. More modern designs use the dmz for such devices as reverse proxies, ftp servers, rds and vdi dateways etc...

if you are twin firewalling for added intrusion prevention as @OtakarKlier suggested then the dmz just becomes a stub network.

[simsim]

Hi,

In twin firewalling case, How the local lan network traffic flow to outside .

Sorry I  really don't undertand twin firewalling case .

If I am going for twin firewalling , how the traffic flow from inside to outside and dmz

Thanks

[Mick_Ball]

Once again there are many variations but in your picture 1, traffic from the lan will go through both firewalls to the internet.

lan traffic to the dmz will only traverse firewall B.

traffic fron the internet to dmz will only traverse firewall A.

traffic from the internet to lan (not recomended) will firstly traverse firewall A and then firewall B.

if you don’t understand it then you probably wont need it.

[Mick_Ball]

To add to my previous post....

For lan traffic to internet....

firewall B will need to be the default gateway for lan.

firewall A will need to be the default gateway for firewall B.

firewall B will be aware of the dmz so will not use the default gateway.

my explanation is very very basic but you will need to add variuos routes and NAT for tis to perform correctly/securely.

[simsim]

Hi,

As per the diagram I posted in the first post , between FW A and FW B is the DMZ zone , 

So the lan traffic to internet should go through this zone ?

Thanks 

[Mick_Ball]

Yes in your diagram 1 the lan traffic will route across the dmz to the internet and your incoming traffic from the internet to the lan will take the same route.

we do not allow this on our network for security reasons but its up to you.

[Mick_Ball]

For your drawing 1 i would do as below.

this way the dmz is independant of your outgoing traffic flow.

the objective of a dmz is to allow sessions to it but no further.

you do not need the dmz on both firewalls you could have it on just one as per drawing 2 but this option will eliminate the trombone effect on the dmz interface.

please excuse my doodle, its an ipad.

[simsim]

Hi,

Thanks for your support .

One final question , You said " we do not allow this on our network for security reasons but its up to you"

Can you explain what are the security reasons 

Thanks

[Mick_Ball]

Hi. No problem but please remember this is a forum and many others will have thier own interpretation of a dmz.

Regarding security...

for me.. no direct connection is allowed from the internet to our lan. It must go via the dmz.

even then it is not alowed to pass through the dmz to the lan.

for example.

lan to ftp server on dmz is allowed.

internet to ftp server on dmz is allowed.

intrenet to remote desktop on the lan is via rds or vdi gateway on dmz.

Internet web access to web server on lan is via reverse proxies on dmz.

The list is quite long but all of the above prevents a direct connection to the lan.

you can of course place your web servers, vdi farms on the dmz to keep it simple but my option saves the requirement of setting up domain trusts to the dmz.

All of the above can still be implemented with drawing 2 but for reverse proxies and vdi gateways this will double up traffic on the dmz interface.....tromboning, not sure if there is such a word.

[Mick_Ball]

Yes, it does exist.... just googled it....

laters.....

[simsim]

Hi,

---

@Mick_Ball wrote:

Hi. No problem but please remember this is a forum and many others will have thier own interpretation of a dmz.

Regarding security...

for me.. no direct connection is allowed from the internet to our lan. It must go via the dmz.

even then it is not alowed to pass through the dmz to the lan.

for example.

lan to ftp server on dmz is allowed.

internet to ftp server on dmz is allowed.

intrenet to remote desktop on the lan is via rds or vdi gateway on dmz.

Internet web access to web server on lan is via reverse proxies on dmz.

The list is quite long but all of the above prevents a direct connection to the lan.

you can of course place your web servers, vdi farms on the dmz to keep it simple but my option saves the requirement of setting up domain trusts to the dmz.

All of the above can still be implemented with drawing 2 but for reverse proxies and vdi gateways this will double up traffic on the dmz interface.....tromboning, not sure if there is such a word.

---

Can you tell me  how the traffic will double up ? 

Thanks

[Mick_Ball]

Ok the following example is for reverse proxy.

single firewall......

web requests enter the outside interface.

then routed to the dmz.

the reverse proxy on dmz then requests the web page from the lan via the same dmz interface,

so you have in and out traffic on the dmz interface.

twin firewall......

web requests enter the outside interface on firewall 1.

then routed to the dmz.

the reverse proxy on dmz requests the web page from the lan via the dmz interface on on firewall 2.

the same scenario applies to various other services within dmz, rdp gateways etc and even dns servers.

if you have just a web server on dmz then tromboning is not so much of an issue.

it all depends on your setup, data demands and services provided.

for a small to medium network, single firewall should suffice.

if your still having issues with the twin concept then happy to post a drawing on monday.

mick.