topic Two tier firewall in Network Security

Two tier firewall

aung.htwe — Tue, 12 Mar 2019 01:17:19 GMT

Hi ,

I have to configuration for data center network with two tier firewall.

Our data centre will DMZ server and Microsoft Lync Server.

Server team advise me to put DMZ servers between two firewall.

So I need to NAT on front end firewall with DMZ LAN and Public IP addres.

At Back end firewall also have to NAT ( internal LAN and DMZ second Interface)

Please check as below link: which design do you prefer?

http://etherealmind.com/design-enterprise-dmz-firewall-clusters/

Please advise me.

Thanks,

Ko Htwe

Two tier firewall

Collin Clark — Thu, 21 Mar 2013 18:25:32 GMT

I usually do a DMZ between the firewalls. I recently did that with a Lync deployment and it works just fine.

Two tier firewall

aung.htwe — Fri, 22 Mar 2013 00:28:13 GMT

Thanks Collin,

Can I used this design? please advise me.

Please advise me thanks,

Ko Htwe

Two tier firewall

Collin Clark — Fri, 22 Mar 2013 00:54:29 GMT

That will work, but it doesn't make much sense and makes it more complicated than it needs to be. Why have dual NIC's in the servers with one in each network? That will make it a routing mess on the servers. Why not have a single NIC in the server and place it in the 192.168.0.0/24 network?

Two tier firewall

aung.htwe — Fri, 22 Mar 2013 01:49:11 GMT

Hi Collin,

This server is lync edge server. My idea is one network card for to NAT with public IP adddress ( 172.16.2.x NAT with Public IP ). One is for the Internal Firewall To NAT with internal network. (20.20.0.x NAT with internal IP 10.10.0.x).

Your suggestion is want to use one NIC with one IP address for DMZ server going to both firewall, is it ?

Please advise me, thanks.

Thanks,

Ko Htwe

Two tier firewall

Collin Clark — Fri, 22 Mar 2013 01:53:56 GMT

By using one NIC in the server, you can accomplish the same thing as two NIC's and I think it keeps the design simpler.

Two tier firewall

aung.htwe — Fri, 22 Mar 2013 02:16:25 GMT

Thanks Collin, I appreciated that.If I will do this design what will be cause the issue and what will have adavantages?

Thanks,

Ko Htwe

Two tier firewall

Collin Clark — Fri, 22 Mar 2013 02:19:04 GMT

What do you mean by cause the issue?

Two tier firewall

aung.htwe — Fri, 22 Mar 2013 02:27:25 GMT

Hi Collin,

If I will use this desing, what is the disadvantages?

Thanks,

Ko Htwe

Two tier firewall

Collin Clark — Fri, 22 Mar 2013 02:31:58 GMT

Compared to what Microsoft wants it to be a disadvantage is that the Edge Server won't be acting as a security device. Also you'll have to create NAT's and ACL's on the backside firewall for connectivity to the corporate LAN. I personally don't see those as disadvantages (and neither do most security engineers), but Microsoft doesn't like it.

Two tier firewall

aung.htwe — Fri, 22 Mar 2013 02:57:46 GMT

Thanks Collin,

Please check it this design, actually I propose this design. Can you advise me for advantages and disadvantages?

Thanks,

Ko Htwe