Re: Web Server Network Setup Questions

["Raul A. Jager W." <raul@xxxxxxxxxx>]

In the setup you describe, I'm sure you can configure the Cisco so it 
will route one port from the Internet to the iSeries, This will be the 
easiest an more efficient way to be able to serve info from the 
iSeries.  Direct and simple. 
The down is that "purists" may object the fact that a computer in the 
internal network can be accessed fron Internet.
If your iSeries has two network cards you can put one in the intenal net 
and the other in the DMZ.
Other setups, like two firewalls or some bridge or firewall between your 
web server and your iSeries will just add complexity, reduce speed, cost 
more, be more prone to fail, etc. but will add no real security, worst: 
it may be even more fragil than an IP forwarding in the Cisco.
_________________________________________________________________________________________________
Tom Jedrzejewicz wrote:

> I get the feeling that the people making those decisions don't really know
> what they are doing.  If the internal network is already connected to the
> internet, getting a separate  internet connection for the web server buys no
> added security.
>
> A simplified version of our setup.  We have a firewall (a Cisco Pix) with 3
> network cards.
>
> The "outside" interface is connected to the internet.
> The "inside" interface is connected to the internal network
> The third interface with a random name is connected to a "DMZ" network.
>
> Rules allow ...
> - the internet access to the DMZ for http and https
> - the internet access to the mail server for smtp
> - the inside access to the internet and the DMZ
> - the DMZ access was specifically configured -- the specific DMZ addresses
> are given access to the specific inside servers and the specific ports
> necessary.
>
> The setup suggested by Mr. Jones is another good option; my preference is to
> have one more complicated firewall rather than two simple firewalls.  The
> Pix we use is relatively pricey.  SonicWall makes good firewalls for less $;
> we have one at another site and it works well.  There are also open source
> firewalls (i.e. http://www.smoothwall.org/).
>
>
> On 8/23/06, Mike <koldark@xxxxxxxxx> wrote:
>  
>
> > While this may not be a usual forum for this, this IS iSeries related. I
> > am
> > just querying the others out here how they do it.
> >
> > We have been using an outside vendor for web hosting and are just now
> > going
> > to be bringing our web site in-house. From what I understand (I just
> > jumped
> > in) there will be a seperate line for the web server (Windows 2003) than
> > our
> > regular internet connection to keep things out of the internal network.
> > However, we want to do a bunch of stuff with our iSeries data (mostly
> > inquiry) which of course is in the internal network. How have you setup
> > your
> > connection for things like this? We have ideas, but have no idea what
> > works
> > best in practice.
> >
> > --
> > Mike Wills
> > http://mikewills.name - Blog