Setting up webserver to work with DMZ and Internal network

Hello, we have a Windows Server 2003 R2 server already setup as a webserver in a DMZ which is working fine.  However we recently installed an anti-virus client on it which needs to be able to "phone home" to a Management Server on the internal network.  We have opened ports specified by the vendor which would supposedly allow it to see the Management Server from within the DMZ, but it still cannot.  The web server has a 2nd NIC on it which we use to connect it to the internal network when needed, but we cannot leave it connected all the time, as this will "confuse" the incoming traffic trying to get to the webserver on the DMZ side.  We were wondering how we can setup the second NIC to allow the server to "phone home" to the internal server while preventing confusion of the web traffic coming in from the DMZ.  Thanks for your help.  Mike
miket71Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Keith AlabasterEnterprise ArchitectCommented:
You don't - you REALLY don't want to do this. You fix the issue that is currently precluding the DMZ server from talking over the internal firewall to the internal server instead.

If you connect another nic directly to the internal network then anyone who gains access to the dmz box has access to your internal network. If the DMZ box DOES get infected, which will be quicker, the main server manages to disenfect the DMZ box or the trojan/virus/whatever activates and is onto your network? Not a risk I would put my name to or expose my organisation to.

Most of the main players in the AV field (Sophos for example) now have two ways to deploy their updates. The first being through an internal server - much as you have by the sound of it. The second being through an on-line portal - and it is this second route that you point devices such as the DMZ servers. Your internal server console should still be able to 'manage' the DMZ box to check status etc but it all goes via the firewall - not a direct connection that bypasses your security perimeter.

Keith
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
miket71Author Commented:
Hi Keith,

We ended up opening the appropriate ports in the firewall to allow the webserver to communicate with the management server from the DMZ connection.  Thanks for your prompt response.

Mike
0
Keith AlabasterEnterprise ArchitectCommented:
More than welcome. :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.