How to design DMZ network and Internal network?

[wcpon_cisco]

Hi Guys,

I'm facing some problem to design my network, hope to get some advice over here..

Please find my current design below...

Current design,

             Fortigate Firewall

                        | |

                 Cisco 3750

             ||                    ||

      Cisco 2960     Cisco 2960

      (VLAN 10)       (VLAN 20)

My web server or application server located at VLAN 10, and my database server located at VLAN 20...

My web server or application server need to communicate with my database server all the time.. (example, user login, authetication, transaction record and etc)

Normal design for the network, web server should place to DMZ network.. because it is face to public network... (untrusted network)....

Database server should be under Internal network. (trusted network)

After the research from the web, DMZ should not be communicate with the internal network (Database server) due with the security concern...

In order the web server (DMZ) communicate to database server, what is the best practise to setup this network?

Should I place the database server to DMZ network as well??

Looking forward to get some expert advice.

Appreciate it...

Thanks.

[Marwan ALshawi]

Well this is depends on the security policy you have

However the option you mention is one possible best practice solution where you place the web server in the DMZ and the DB server in the internal network and only permit the required ports for server to server from DMZ to the DB server

Another option you create two DMZs zones one for the web less secure and another for the DB more secure and allow only the required ports between these two zones and this is more secure because in the case of one of the servers got compromised won't effect your inside network and keep it isolated

Hope this help

Sent from Cisco Technical Support iPad App