• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1710
  • Last Modified:

DMZ with 1 single firewall VS 2 firewall tier

Hi,

Could someone help me out to figure this out?

There is a customer that has 1 single firewall and through the rules and interfaces has created a DMZ and then traffic from the DMZ is allowded to the inner network (other VLANs)

Can someone tell me why a 2 firewall tier will be better a better aproach for the DMZ?

Basically : 1st Firewall -> DMZ -> 2nd Firewall ---> inner network  

Thank you!
0
llarava
Asked:
llarava
3 Solutions
 
malkaj01Commented:
The DMZ tier allows you to place the clients that should have the DMZ properties.

This way you can protect your network behind the second firewall.
0
 
AngloCommented:
Both provide the DMZ functionality but the 2nd firewall increases the security of the inner network in the event of the first firewall being compromised.
0
 
StrifeJesterCommented:
Going with the post above and maybe expanding a little.  We use a 2 firewall system here and if you can you should even try to run 2 different vendor firewalls.  This increases the security if one is compromised due to a vulnerability the other may not have that vulnerability.  Also there can be other issues with a "soft" DMZ when it comes to routing from time to time.
0
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

 
llaravaAuthor Commented:
Thanks everyone but so far I haven't seen anything that I already didn't know. Let me ask this in a different way...what is the drawback of running at single firewall for the DMZ?
0
 
llaravaAuthor Commented:
I was looking a better argument.
0
 
StrifeJesterCommented:
I know you closed but I was away all weekend and maybe this will help.  The foremost drawback was mentioned in the fact that using a single firewall increases the chances of a breach.  But it also increases load on your system.  If you have this in an environment where any device has an external IP or you have a range it is going to get hit with port scans and any other number of random events.  Keeping these on the edge will reduce the load on a interior system and can help performance.  If you have a lot in your DMZ that you access from inside the building or through VPNs and things there is a better chance of these services being more reliable since the outer firewall will filter a lot of the junk that is out there.  Hope this helps.
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now