topic Re: DMZ configuration in Network Security

DMZ configuration

nocret808 — Mon, 11 Mar 2019 09:49:46 GMT

I would like to find out on what is the best practice on setting up Windows Media Server on DMZ. I am trying to setup a WMS server on the DMZ and would like this DMZ server to communicate with my SQL server on my internal network. Below is my configuration.

Re: DMZ configuration

nocret808 — Wed, 21 Mar 2007 04:56:26 GMT

forgot to attached config

Re: DMZ configuration

acomiskey — Wed, 21 Mar 2007 13:14:30 GMT

Whats wrong with it? Looks ok to me.

Re: DMZ configuration

lq01010101 — Wed, 21 Mar 2007 13:58:22 GMT

expect

Re: DMZ configuration

nocret808 — Wed, 21 Mar 2007 14:00:33 GMT

the DMZ server cant get to my SQL server on my internal network. the other thing im concern is, is this a best practice in allowing DMZ traffic to my internal network? i just want to get some idea.

thanks

Re: DMZ configuration

suschoud — Wed, 21 Mar 2007 14:00:52 GMT

yeah.the configuration is absolutely fine.

and you have followed the best practices. 🙂

static is there for the translation purpose between the inside and dmz.

on the dmz interface,there's an access-list which permits the sql data to inside,then there's a deny which denies the rest of the traffic to inside and then there's a permit ip any any for internet access in dmz.

good approach.

let us know if there's any specific question/issue/concern that you might have

Regards,

Sushil

Cisco TAC.

Re: DMZ configuration

suschoud — Wed, 21 Mar 2007 14:02:05 GMT

hi,

could you please attach the syslogs generated while you attempt to connect to the sql server in inside.

the config. is ok.

Regards,

Sushil

Cisco TAC.

Re: DMZ configuration

nocret808 — Thu, 12 Apr 2007 23:53:05 GMT

Thanks. The question that was raised was: by allowing communication from dmz to the sql server, someone can potentially break or hack into my inside network via the dmz. What they also want to do is to have this DMZ server have Internet capability for Windows patching. i am not sure if im in favor in doing this. please advise.