Setting up DMZ zone

[LovejitSingh1313]

Hello @balaji.bandi  @Aref Alsouqi  @Marius Gunnerud  @Rob Ingram @Nithin Eluvathingal @Richard Burts @Marvin Rhoads 

I have one Web server(VM1) which is uses other server as a database server (VM2) and use 3rd server as application server(VM3). Only Web server needs access from internet on port 443. I want to move VM1-web server to DMZ and then open port 443 LAN access to it so that internal users can also connect to it.
I am bit confused between following things :
1. Should I moved all three servers to DMZ or just move VM1 to DMZ and then setup granular access from DMZ to VM2 and VM3 ?
2. which ASA features I should have enabled to make sure DMZ is inspected at highest level? like IPS, AV scan etc.
3. What other things I should consider setting up DMZ?

I am already considering a GoDaddy Certificate for encrypted sessions, what else should i keep in mind?

Thanks,

[Rob Ingram · Accepted solution]

Hi @LovejitSingh1313 

Move only the Webserver to the DMZ and permit inbound tcp/443 from the internet. Permit traffic from the webserver in the DMZ to the application and database servers, ensure you permit only the required ports.

Use an FTD instead of ASA if you want to use IPS features.

You could also consider a host based firewall on the webserver in the DMZ.

Restrict outbound access from the DMZ server to the internet.

HTH

[balaji.bandi · Accepted solution]

Only exposed Web Server will be in DMZ, rest Applicaiton and DB should be internal

you can deploy 2 Leg deployment to single leg deploy in DMZ depends on the business.

FQDN should be always CA Certified with Godaddy is good idea. internall you can configure your own DNS with internal IP address.

[LovejitSingh1313]

Hello @balaji.bandi , 

what does 2 leg deployment and single leg deployment means ?

Hello @Rob Ingram ,

What does host based firewall does which gateway firewalls do not capable of ?

Thanks,

[Rob Ingram]

A "leg" is basically referring to an interface of the firewall, where an interface relates to a zone - such as inside, outside and dmz.

A hosted based firewall will restrict inbound and outbound connections to/from the webserver itself. This could be useful to prevent lateral movement in the DMZ vlan (assuming you had multiple servers in the same DMZ vlan). This L2 traffic would not be sent via the firewall, so a hosted based firewall could be useful in this scenario.

[Richard Burts · Accepted solution]

I agree with the suggestions that you should put only the single server which needs to be accessible from the Internet into the DMZ. You should only expose the resource which needs to be accessible. I would suggest that for this server to be accessible from outside that you will need either a static NAT to a dedicated Public IP or will need port forwarding to send Internet originated traffic to the server.

[LovejitSingh1313]

Hello @Richard Burts  @Rob Ingram  @balaji.bandi 

Thanks for feedback.

All three servers are AD Domain joined, as Web server is moving to DMZ zone which is restricted to Domain Controllers. Should I remove it from Domain ? 

What's the best Practice in this case ?

Thanks

[balaji.bandi]

DMZ server joining AD is common practice for people to Login to maintain, So you have dual leg or single leg deployment,

So you only control with FW policy to communicated only Limited Service required on direction or bi-direction policy based on the requirement.

[Rob Ingram · Accepted solution]

If the server you are placing in the DMZ remains connected to the domain, it will require a lot of ports open from the DMZ to the LAN where the Domain Controllers (DC) are located, exposing the DCs to the DMZ, this would be unwise.

Ideally the DMZ server would not be joined to the domain and you are only permitting the ports to the inside network to the application servers required for the application to work.