I am contemplating this architecture:
INTERNET | CISCO PIX FW ------- DMZ FTP SERVER | | ------------------------------ | | | | NT CLIENT NETAPP
The DMZ FTP Server would have an a UDP NFS mount THROUGH THE FIREWALL into the internal network. Inbound guest FTP would be directed there via the Netapp NFS mount. The NT box would have a covering SMB mount over the same filesystem. After a guest client delivers data to the FTP server it would be moved from the in to the out directory where it would be picked up by the internal NT box.
Intent: Maintain an Internet-visible FTP server in the DMZ and yet provide easy access for inside servers.
Question: 1. Does this make sense? Does anyopne use filers this way or in related ways? 2. Are there known exploits against filers doing UDP NFS as I describe above. Could the Netapp be attacked if the FTP box were hacked? 3. Related question: Can admin access to the filer be to ONLY the console port or ONLY a single interface?
Thanks - Jim Klun
* James A. Klun Sterling Commerce 4600 Lakehurst Ct. Dublin, Oh 43016 * * jklun@stercomm.com 614-793-7183 voice 614-793-7092 fax * * ---- "very like a whale" ---- * * ---- Hamlet, Act 2, Scene 2 ---- *