Webserver on Network, Need support references on how the PA devices can help secure your network

Showing results for 
Search instead for 
Did you mean: 

Webserver on Network, Need support references on how the PA devices can help secure your network

L0 Member

We have a client that is very concerned about having a webserver on a network that is open to the internet.  They already use exchange and as such ports 80 and 443 are open to that exchange server on the network.  We are hoping to put a webserver on the same network, but are experiencing push back.  The client is of the mind that a webserver must never be placed on an internal network with open ports to the internet.  I am hoping to find some resources on how the use of some of the features that Palo Alto devices provide can help mitigate that risk.   I know that next-gen firewalls such as Palo Alto has cut down on the risk of having a webserver on your network without the use of a DMZ I just need some whitepapers or other trusted resources to back that claim.   


L5 Sessionator


You can start configuring policies for your web server to protect from Denial of Server Attacks:

How to protect web-server using DOS policy

Not to forget, that you an apply AV, anti-spyware and vulnerability profiles to the security rule which is responsible for allowing traffic. Plus, you granularize your security rule based on allowed applications only.

Threat Prevention Deployment Tech Note (page 18-28)

Hope that helps!

Thanks and regards,

Kunal Adak

Put the webserver in a DMZ and use the security profiles to protect it

L7 Applicator

Generally, any subnet that has servers hosting internet facing applications should be in a different security zone than the rest of the internal network.  This is the basic definition of the DMZ that has existed from even before the internet when we connected to networks outside our companies.

I don't think web servers are any more vulnerable to compromise from the outside than Exchange.  But I guess hosting a public web site does give more of an advertisement and invitation to visit than spinning up OWA.

So in general, I would suggest creating a DMZ to isolate the public web server and setup the necessary network and security policies from there.  I would encourage moving the Exchange Frontend at least into the DMZ as well.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

L4 Transporter

Putting a server in a DMZ doesn't have to mean it's fully open. A DMZ zone is no different to any zone to me, I protect all my zones equally.

Because of the nature of webservers, there will always be a bigger risk, that's why you don't want that (directly) in your internal network...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!