DMZ Default route for servers

[Fortimaster1]

Hi all,

I'm changing some things on my network. Currently (in summary) I have a DMZ with two Fortigate and one switch. The servers and the firewalls connect to the switch.

Each server has 2 static routes

1º)Default route --> IP address of the external fortigate.

2º)Route to reach internal private addresses -->Internal fortigate.

I'm thinking about configure the servers with just one default route for the switch that connects them. This switch, sends traffic to external or internal firewall and Doesn't route any traffic between DMZ network and other networks. 

Server-->Switch-->Firewall Internal / Firewall External.

If I use a firewall as default gateway for servers, some times the traffic will have more hops than I want. Example

Traffic from server DMZ, to server Datacenter:

                  -ServerDMZ-->switch(layer 2)-->firewall external-->Switch another time-->Firewall internal.

What do you think about using a single default route to layer3 switch, that interconnects everything and it doesn't route between DMZ and other networks. It only sends traffic to internal or external firewall. It's an acceptable design to a DMZ in your opinion?

Thanks

[Toshi_Esumi]

Doesn't the "server Datacenter" have a private IP to be reached via the 2nd static route on the DMZ servers? Then it shouldn't go to the external FGT. 

Toshi

[Fortimaster1]

Thanks ¡¡ I'm talking about DMZ servers.

Yes, actually they have two static routes: Default (external firewall) and 2nd static route to the datacenter servers (internal firewall).

I would like to use only one default route (to the switch that connect both firewalls and servers).

[Toshi_Esumi]

So you're saying you want to eliminate any other static routes on the DMZ servers? If your switch is a L3 switch, yes, you can. Then the switch needs to have 1) default route to the external FGT, and 2) those necessary static routes to the internal FGT, instead.

Toshi

[Toshi_Esumi]

In other words, the path between the internet and the DMZ servers will have one more hop, the L3 switch.
Internet <-> external FGT <-> L3 switch <-> DMZ servers
You need to add a new small /31 or /30 subnet between the external FGT and the L3 switch. And obviously need to add a new static route on the external FGT for the DMZ subnet, which is now not directly connected.

Toshi

[Fortimaster1]

Thanks Toshi. I know that is possible, if we are talking about routing. What I wonder is whether it is not recommended for some really important reason. I can't think of any, since north-south traffic will always be analysed by firewalls and traffic will always pass through the switch, even if it is not the gateway, since it interconnects everything.
On the other hand if I do that, my idea is not to use a different networks between firewalls and switch, all of them can have an IP address in the DMZ network.

[Toshi_Esumi]

Those are routing options you just need to decide, either make the switch as L2 one or L3 one. There is no difference security-wise. I personally prefer a L2 switch option since one less L3 node to worry about. But it's just a matter of preference.

Toshi

[AEK]

Your suggested design seem to work fine and seem better than the existing. But the first question I'd ask when it comes to design is: does it follow standards?

[Fortimaster1]

AEK,I'm not sure if he follows them. That's why I'm asking if it's a reasonable design, taking into account all aspects and comparing it to the current one (with some static routes in the servers).

[AEK]

I'm also not sure, but as long as the L3 switch doesn't route traffic between VLANs (without filtering) then you should be safe.

On the other hand a standard design that I always follow and I'm always happy with it is to attach the DMZ to the edge firewall only, even if the traffic transit through 2 firewalls instead of one. It is true that it is less performance but this little performance difference was never required in my case.

You know in enterprise environment we should always follow standards, otherwise one day some expert or some audit will find strange things and will ask who did this s***?!! (sorry for the expression)