DMZ question

[NInja Black]

Hi,

 I have a DMZ network setup on ASA5525. The windows servers in the DMZ are accessible from outside from salesforce.com ip addresses only and from our internal LAN from the inside. These servers need to connect to the SQL servers on the internal LAN.

These windows servers need periodic windows updates. How do I config the DMZ so that the servers can get windows update automatically. Also is the current access from outside and the internal network the most secure way? Please advise.

[Karsten Iwen]

"most secure way" is never a fixed value. For even more security you could place your SQL-servers in an additionally DMZ to also separate them fron the rest of the network.

For communication from DMZ to SQL-Serves: Just allow the relevant ports in the DMZ-ACLs.

For allowing windows updates, I prefer to set up a dedicated WSUS in a DMZ-network. All Windows Servers connect to the WSUS and don't need their own internet-access. If you don't want a WSUS or a dedicated proxy for internet access, you could allow the servers to directly connect to the relevant domains for windows update.

[NInja Black]

I guess the security level I have setup is secure enough. Don't want to have another DMZ just for the 1 SQL server we have.

WSUS is wjat we are looking into right now.

Thanks Karsten.