Re: [SAGE] Questions about a DMZ config

[Cat Okita <cat@reptiles.org>]

On Thu, 11 Jan 2007, Neil Watson wrote:
> I've come across a DMZ design that I've not seen before.  It seems
> somewhat flawed to me.  I'd like to hear the opinions of other Sage
> members.
>
> Internet
>  |
> FW
>  |
> 192.168.32.0/24
> (web servers, external DNS, mail gateways)
>  |
> FW
>  |
> 192.168.42.0/24
> (middle-ware)
>  |
> FW
>  |
> Internal Network.

It's not an unusual configuration - I've seen it in a variety of
environments.  It's designed to isolate components, and typically also
uses different types of firewall, for better defence against monoculture
vulnerabilities.

> Is this type of arrangement typical?  Is another DNS service required to
> fix this problem or there a more serious flaw?

I'd normally expect to see split DNS here...

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."