Re: Web Server Network Setup Questions

["Tom Jedrzejewicz" <tomjedrz@xxxxxxxxx>]

I get the feeling that the people making those decisions don't really know
what they are doing.  If the internal network is already connected to the
internet, getting a separate  internet connection for the web server buys no
added security.

A simplified version of our setup.  We have a firewall (a Cisco Pix) with 3
network cards.

The "outside" interface is connected to the internet.
The "inside" interface is connected to the internal network
The third interface with a random name is connected to a "DMZ" network.

Rules allow ...
- the internet access to the DMZ for http and https
- the internet access to the mail server for smtp
- the inside access to the internet and the DMZ
- the DMZ access was specifically configured -- the specific DMZ addresses
are given access to the specific inside servers and the specific ports
necessary.

The setup suggested by Mr. Jones is another good option; my preference is to
have one more complicated firewall rather than two simple firewalls.  The
Pix we use is relatively pricey.  SonicWall makes good firewalls for less $;
we have one at another site and it works well.  There are also open source
firewalls (i.e. http://www.smoothwall.org/).


On 8/23/06, Mike <koldark@xxxxxxxxx> wrote:
> While this may not be a usual forum for this, this IS iSeries related. I
> am
> just querying the others out here how they do it.
>
> We have been using an outside vendor for web hosting and are just now
> going
> to be bringing our web site in-house. From what I understand (I just
> jumped
> in) there will be a seperate line for the web server (Windows 2003) than
> our
> regular internet connection to keep things out of the internal network.
> However, we want to do a bunch of stuff with our iSeries data (mostly
> inquiry) which of course is in the internal network. How have you setup
> your
> connection for things like this? We have ideas, but have no idea what
> works
> best in practice.
>
> --
> Mike Wills
> http://mikewills.name - Blog
> http://theriverbendpodcast.com - Podcast
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.