Dylan,
This was just about the jist of my reply to Brian. We do have several NIC's in the Filer as of yet unused which could be routed to the DMZ.
But it does open an entire IP stack to the DMZ whereas opening just the NFS ports through a hole in the Firewall exposes just the NFS port...
-Bob
At 07:26 PM 3/19/2003 +0000, Dylan Northrup wrote:
On Wed, 19 Mar 2003, Brian Long wrote:
:=The filer should live on your DMZ :) No holes through firewalls to :=worry about. In fact, it should be on a private VLAN that only your web :=server(s) can see.
Also, if it is necessary to have access to boxes inside your firewall access the filer, you can put in another ethernet card and have an interface on the DMZ and one inside the trusted network. Since the filer doesn't route packets the practical worry is greatly minimized.
I'd also deny any NFS traffic through the firewall and any traffic period to the filer that doesn't come from inside the DMZ as well as keeping a very tight lock on the exports file on the filer (including not exporting vol0 to anything inside the DMZ).
-- Dylan Northrup northrup@loudcloud.com Unix System Administrator EDS Automated Operations