ACE Security design question

[dclee]

We currently use 2 ACE 4710's in active standby mode in our DMZ to terminate all inbound SSL connections to backend web servers.

To date this has worked well.

The Ace's are in one arm mode hanging off one of our Firewall DMZ interfaces.

I also use one ACE 4710 internally to load balance our exchange environments. This has also worked well..

But

I would like to move the Exchange load balancing to our ACE cluster in the DMZ and repurpose the internal ACE for our LAB.

From a design perspective are there any security concerns sending our Exchange traffic thru the firewall to the DMZ ACE's which are

internet facing ?

Of course the ASA will be handling all of the ACL's, so I dont see a problem with the design..

Was looking for advice / opinions

Cheers

Dave                  

[pablo.nxh]

Hi Dave,

Personally I don't see any flaw on doing this. Assuming that currently your SMTP traffic is flowing from the ASA outside-> inside interface -> to the internal-ACE VIP and from there to your servers, if this is the case, then moving your exchange servers to the DMZ will only represent a small NAT/Routing configuration on your ASA and a matter of replicating the configuration from ACE to ACE considering the IP changes.

The other (unlikely) scenario is that SMTP traffic is not going through the ASA and somehow routed directly from the internet facing router to the ACE, in this case you'll be adding security to the connection which is just great!

I feel that most of the considerations need to be made from an ASA point of view (security-levels wise), on the ACE side, no biggie!

HTH

__ __

Pablo

[dclee]

Here is what we are looking to do for internal client mail connections

[pablo.nxh]

Dave,

I don't see a problem with your new design; just keep in mind you'll be moving to what's called a "routed" mode so the DMZ-ACE needs to be configured with an IP from the internal VLAN, you can either configure the current connection between the ASA and ACE as a trunk or just connect one of the ACE ports to the internal switch.

You'll need source NAT performed on the ACE to avoid asymmetric routing specially for the request coming from the internal VLAN (reverse proxy).

HTH

__ __

Pablo

[Jorge Bejarano]

Hey David,

How are you?

I hope eveything is good in Canada!

Your plan looks good and should go well!

Jorge