DMZ systems having internal IP, ok or not?

[#1]

Hi, I am new here. Nice to meet you guys :) Here is my first question: We are using Fortigate 3800 as firewalls. The DMZ contains external DNS, web and proxy servers. Systems in DMZ use subnet 192.168.1.0, and the internal systems use subnet 10.1.1.0. My questions: Can we assign two IP addresses to each DMZ server, one IP in 192.168.1.0 subnet and one IP in 10.1.1.0 subnet? Is there any way to prevent security issues from occuring by using this type of configuration? Thank you much in advance!

[ede_pfau]

Hi, and welcome to the forums! You can set up a destination NAT so that 10.1.1.x is mapped to the DMZ' s 192.168.1.x, for single servers or subnets also. This will be effective for traffic coming from ' internal' and aimed at ' DMZ' . Destination NAT is constructed using a ' Virtual IP' or VIP. See Firewall>Virtual IP. The parameters look like Ext. IP: 10.1.1.66 Ext. Interface: internal Mapped to IP: 192.168.1.14 (any real IP) Mapped to interface: DMZ Then put the VIP into effect in a policy: from: internal source: your_LAN to: DMZ destination: this_VIP (!) service: ... schedule: ... action: ACCEPT NAT: enable Traffic destination 10.1.1.66 will get replaced with 192.168.1.14 now. Note that this is only effective for that particular interface pair. For translating whole subnets (with a 1:1 mapping) see the FortiOS Handbook, Firewall chapter, VIP. HTH.

[#3]

Thanks a lot for answering my questions in the weekend. It is very Informative and I need to spend some time to study it. What I understand is that DMZ systems are NOT supposed to access internal systems. Then how can DMZ systems contain internal IPs? " 10.1.1.x is mapped to the DMZ' s 192.168.1.x" - For this statement, what I understand is that this configuration is done on the firewall. It is just a virtual mapping, and does not mean DMZ systems having internal IPs. Have a nice Sunday!

[rwpatterson]

Any interface can contain any IP subnet scheme you can think of. Any interface can be named or used in any manner you want (more or less). You can use RFC compliant ' internal' IPs or public IPs (even if you don' t ' own' them) for these interfaces. The firewall does all the work in letting the outside in, and NAT-ting those addresses to be Internet compliant. The DMZ subnet scheme SHOULD NOT be in the same subnet as the internal subnet. You can do it (with a bunch of CLI commands), but it makes no sense. The DMZ should have private IPs, but on a different subnet as your internal subnets. Hope that helped.

[#5]

Thank you for the explanation. Our web, external DNS and proxy servers contains two IPs, one in 192.168.1.0 and one in 10.1.0.0. This means they are in both the DMZ subnet and the internal subnet. All internal servers are in 10.1.0.0 subnet. Does this setting make any sense? I doubt it. If hackers break the DMZ, they can easily access to internal systems. Am I right here? Does Fortigate firewall have a way to prevent this from happening?

[rwpatterson]

The best way to protect your internal servers is to make the DMZ what its supposed to be. Remove the NIC for the internal network, and create the appropriate access from the internal side so that a hacker cannot compromise your network via the DMZ servers. With the DMZ servers residing on the internal network as well, they bypass the firewall. No firewall that I know can intercept packets between 2 servers directly.

[#7]

This is also what I thought. Thank you!

ORIGINAL: rwpatterson The best way to protect your internal servers is to make the DMZ what its supposed to be. Remove the NIC for the internal network, and create the appropriate access from the internal side so that a hacker cannot compromise your network via the DMZ servers. With the DMZ servers residing on the internal network as well, they bypass the firewall. No firewall that I know can intercept packets between 2 servers directly.

[ede_pfau]

just a suggestion: to get a notion what a DMZ is meant to be or how you configure one you can search the ' Firewall' forum for ' dmz' or ' servers' . One of the most recent examples is here http://support.fortinet.com/forum/tm.asp?m=70457 The concept of a DMZ is discussed on the net as well - best practices, placing of servers, getting servers updated in a DMZ etc. - whereas the technical details such as NATting or Virtual IPs which are specific to the firewall are found here.