Network design help

[wantagofast]

I am embarking on posting our first company web site. My network setup is this:

internet <- router <- pix <- DC/member ser./term. ser. <- workstations

My questions are: (1)Is hosting the web site on a separate Windows server sufficient or do I need to host the site on a ISA machine? (2)If a Windows server is sufficient without ISA, do I place the server between the router and pix or just behind the pix.

Thanks.

Matt

 

[rburke]

It matters on the equipment and how you want to implement it. First question... what model PIX is it? If it is a 525 or above then it can have more than 2 interfaces and I'd recommend a Inside, Outside and DMZ interface. Then the server would sit in the DMZ area and minimize damage to the LAN if it was compromised.

Putting the server between the router and PIX is called a "poor man's" DMZ. You are still isolating the server from the internal LAN but it is not quite as seucre a being on its own PIX interface. Also you'll need to implement security features in the router to protect the server from the big bad Internet.

As far as the server, it really is all about the amount of traffic. Chances are if you are just putting it up then the Windows server and a "poor man's" DMZ will work fine. But when traffic gets a little heavier I would suggest in upgrading the PIX (if needed) and put it on a PIX DMZ interface.

Let me know if this helps.

Burke

 

[wantagofast]

Thanks Burke for the response. We are a small company so resources are low. A DMZ would be my first choice but again that requires resources. The pix I am using is a 506 and I believe it only has one interface so I will have to make do with a "poor man's" DMZ.

Thanks again.

Matt