Cisco Blogs

Cisco Blog > Perspectives

DMZ Basics

Lately I made the change from deep technical consultant to a more high-level architect like kind of consultant. I now do my work on the turning point between business and technique. One of my first jobs is to make my customer ready for an audit to use the dutch official authentication method, which is called DigID.

There are several requirements, which have to be fulfilled before the customer can make use of the DigID authentication method. One of these requirements is that all the internet facing systems are placed in a DMZ. I tried to explain the importance of a well functioning DMZ. For us as network specialists this fact is obvious, but a lot of people don’t understand the meaning and working of a DMZ. This blog is about the essentials of which a DMZ has to consist.

First we need to understand what we are trying to achieve with a DMZ
• Separation and identification of network areas
• Separation and isolation of internet facing systems
• Separation of routing and security policies

After understanding the achievements, there is another point of interest. Are you gonna build your DMZ with dedicated switches, firewall’s and ESX hosts (physical) or do u use a separate vlan (virtual). There is no clear answer; fact is that bigger organizations build physical DMZ’s more often than smaller ones. Besides the technical aspect, there is off course a financial aspect. Resulting out of the physical/virtual debate comes the debate whether to use two physical firewalls or one physical firewall with several logical interfaces. Equally to the physical/virtual debate there is not just one answer.

For me personally one physical firewall with several logical interfaces with tight configured ACL’s is as good as two physical firewalls. One could dispute this with the argument that if a hacker gains access to one firewall he gains access to the whole network. Personally I don’t think this isn’t a valid argument, because when two physical firewalls are used they are often from the same vendor and use the same firmware with the same bugs and exploits. So if the hacker’s trick works on one firewall, it will often also work on the second one.

Some images to make the above a little more concrete.

A single firewall DMZ:

DMZ Basics

Read More »

Tags: , , , ,

One Policy for the BYOD Challenge

Man on LadderSeveral years ago, I had a conversation with an IT manager about his company’s network security that I still remember today. He said: “We’re losing our battle over internal network security. We cannot keep up with our vendors and contractors who bring in all kinds of devices to our network. We may turn our internal network into a DMZ.” Turning an internal network into a DMZ was probably an extreme case at that time but it showed the underlying problem: if you don’t have control over what’s happening on your network, you’ll have an uphill battle in your hands.

Today, the challenge has intensified due to the bring-your-own-device (BYOD) trend. There are speculations that corporate networks may eventually turn out to be the equivalent of college networks where users routinely bring their own personal devices. Because personal devices generally do not have the same level of security as IT-owned assets, they tend to have more vulnerabilities and it’s harder to protect sensitive information and intellectual property on these devices. The adage, “security risks walk in the door with employees” is quickly becoming a reality that organizations must address.

Read More »

Tags: , , , , , , , ,