We have a client that is very concerned about having a webserver on a network that is open to the internet. They already use exchange and as such ports 80 and 443 are open to that exchange server on the network. We are hoping to put a webserver on the same network, but are experiencing push back. The client is of the mind that a webserver must never be placed on an internal network with open ports to the internet. I am hoping to find some resources on how the use of some of the features that Palo Alto devices provide can help mitigate that risk. I know that next-gen firewalls such as Palo Alto has cut down on the risk of having a webserver on your network without the use of a DMZ I just need some whitepapers or other trusted resources to back that claim.
You can start configuring policies for your web server to protect from Denial of Server Attacks:
Not to forget, that you an apply AV, anti-spyware and vulnerability profiles to the security rule which is responsible for allowing traffic. Plus, you granularize your security rule based on allowed applications only.
Threat Prevention Deployment Tech Note (page 18-28)
Hope that helps!
Thanks and regards,
Generally, any subnet that has servers hosting internet facing applications should be in a different security zone than the rest of the internal network. This is the basic definition of the DMZ that has existed from even before the internet when we connected to networks outside our companies.
I don't think web servers are any more vulnerable to compromise from the outside than Exchange. But I guess hosting a public web site does give more of an advertisement and invitation to visit than spinning up OWA.
So in general, I would suggest creating a DMZ to isolate the public web server and setup the necessary network and security policies from there. I would encourage moving the Exchange Frontend at least into the DMZ as well.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!