Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Setting up webserver to work with DMZ and Internal network

Posted on 2012-03-22
3
618 Views
Last Modified: 2012-03-23
Hello, we have a Windows Server 2003 R2 server already setup as a webserver in a DMZ which is working fine.  However we recently installed an anti-virus client on it which needs to be able to "phone home" to a Management Server on the internal network.  We have opened ports specified by the vendor which would supposedly allow it to see the Management Server from within the DMZ, but it still cannot.  The web server has a 2nd NIC on it which we use to connect it to the internal network when needed, but we cannot leave it connected all the time, as this will "confuse" the incoming traffic trying to get to the webserver on the DMZ side.  We were wondering how we can setup the second NIC to allow the server to "phone home" to the internal server while preventing confusion of the web traffic coming in from the DMZ.  Thanks for your help.  Mike
0
Comment
Question by:miket71
  • 2
3 Comments
 
LVL 51

Accepted Solution

by:
Keith Alabaster earned 500 total points
ID: 37756030
You don't - you REALLY don't want to do this. You fix the issue that is currently precluding the DMZ server from talking over the internal firewall to the internal server instead.

If you connect another nic directly to the internal network then anyone who gains access to the dmz box has access to your internal network. If the DMZ box DOES get infected, which will be quicker, the main server manages to disenfect the DMZ box or the trojan/virus/whatever activates and is onto your network? Not a risk I would put my name to or expose my organisation to.

Most of the main players in the AV field (Sophos for example) now have two ways to deploy their updates. The first being through an internal server - much as you have by the sound of it. The second being through an on-line portal - and it is this second route that you point devices such as the DMZ servers. Your internal server console should still be able to 'manage' the DMZ box to check status etc but it all goes via the firewall - not a direct connection that bypasses your security perimeter.

Keith
0
 

Author Comment

by:miket71
ID: 37756874
Hi Keith,

We ended up opening the appropriate ports in the firewall to allow the webserver to communicate with the management server from the DMZ connection.  Thanks for your prompt response.

Mike
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 37757018
More than welcome. :)
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
VPN Connection WIndows 10 5 60
ip igmp join-group 8 39
Setting out for Cisco UCS 2 19
Vyos VLANs 14 33
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question