Right, you'll need an access device in the DMZ. The terms can change, but basically you need some kind of reverse-proxy/SSL VPN/etc.
The users connect to that device with an ordinary web browser, then select the back end resource they want to connect to. If they are web applications it might look like https://mydmzserver.mycompany.com/server1 to connect to the LAN server1 https://mydmzserver.mycompany.com/server2 to connect to LAN server 2 Examples of products that can do this include Nokia Secure Access System, Nortel Alteon SSL VPN, Aventail SSL VPN, and the Check Point Connectra. Shane On Thu, 12 Aug 2004 14:52:02 +0530, Naseer Inamdar <[EMAIL PROTECTED]> wrote: > Hi all, > > As per our network policy, nobody should access the servers on the LAN from > INTERNET directly. We have two checkpoint firewalls connected back to back > separating DMZ zone. > > Internet > | > Router > | > Checkpoint firewall-1 > | > | ---------------------------------------------- DMZ > | > Checkpoint firewall-2 > | > | > LAN > > Both checkpoint firewall have different Policies and are not in load > balancing mode.The strategy is to have defense in depth approach. All > Internet bound traffic terminates to protected DMZ. However we have few > servers that are present on LAN, that are required to be accessed over > Internet. The amount of access to these servers from Internet will be less > compared to the LAN users, hence cannot be shifted to DMZ. What would be the > best practice for accessing these servers. These users want access without > VPN connectivity as they dont carry laptops. > > I have thought of the following solution: > > Install a reverse proxy server for eg: ISA firewall that hosts these > internal servers. All access to these servers shall be then via ISA- > firewall which sits on DMZ and communicates to these internal servers via > Checkpoint firewall-2. through a secure channel like SSL. > > Since ISA firewall hosts multiple servers. How a person can access different > servers -- for eg: server1, server-2 > Note: DMZ is on invalid ip nated to Valid IP on Checkpoint firewall-1 > > Awaiting for more inputs and other best solutions > > Thanks and Regards > Naseer.Inamdar > > ---DISCLAIMER------------------------------------------------- > The contents of this E-mail (including the contents of the > enclosure/(s) or attachment/(s) if any) are privileged and > confidential material of Mahindra and Mahindra Limited (M&M) > and should not be disclosed to, used by or copied in any > manner by anyone other than the intended addressee/(s). If > this E-mail (including the enclosure/(s) or attachment/(s) > if any ) has been received in error, please advise the > sender immediately and delete it from your system. The views > expressed in this E-mail message (including the enclosure/(s) > or attachment/(s) if any) are those of the individual sender. > -------------------------------------------------------------- > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
