Security Basics mailing list archives
Re: DMZ / Firewall rule diagramming
From: Spigga <spigga () gmail com>
Date: Tue, 7 Dec 2004 14:00:39 -0600
Man I had a meeting yesterday withg Solsoft and their application not only gives you a very clear picture on the traffic but will configure all the devices in the path to allow traffic by drawing the line. Looks VERY nice, though so does the price.... I wish I could have just the drawing part for free. On Sun, 05 Dec 2004 22:47:20 -0700, Michael Gale <michael.gale () bluesuperman com> wrote:
Hello, I understand what you want now ... I don't believe this has every been done as a standard. Michael. Craig Humphrey wrote:Hi Michael, From the responses I'm getting, I don't think I explained the situation very well. I'm not after "how to write rules" or "what rules should I have". I'm looking for a generic way to diagram the rules I already have. Preferably something nice a visual (like Visio), but even Visio starts to get cumbersome with a complex DMZ, even breaking flows/rules into layers only goes so far. I was hoping that the industry had developed some formal standards for diagramming DMZs and flows/rules. Thanks Craig-----Original Message----- From: Michael Gale [mailto:michael.gale () bluesuperman com] Sent: Monday, December 06, 2004 3:26 PM To: Craig Humphrey; security-basics () securityfocus com Subject: Re: DMZ / Firewall rule diagramming Hello, Check out some firewall appliances ... most of them have some sort of standard. For example I used the following: Connections from Internal to the DMZ are allowed if they match one of the forward rules on the firewall. The forward rules only allow packets from sources addresses to destination addresses on specific ports which are ruled to be a business requirement. For connections coming from the DMZ to the internal network which are required for business (Example. Postfix SMTP server to forward mail on to Exchange). The DMZ server connects to a proxy or a NATing rule. DMZ server never know the IP of a internal server, the DMZ network has the same relations with the internal network as the external network does with the DMZ. So the DMZ mail server would connect it port 25 on the firewall and that traffic would get forwarded to the Exchange server. That is the standard that I use ... was this what you were looking for ? Michael
Current thread:
- DMZ / Firewall rule diagramming Craig Humphrey (Dec 01)
- Re: DMZ / Firewall rule diagramming Charles mckee (Dec 02)
- Re: DMZ / Firewall rule diagramming Michael Gale (Dec 06)
- <Possible follow-ups>
- RE: DMZ / Firewall rule diagramming Craig Humphrey (Dec 03)
- Re: DMZ / Firewall rule diagramming Spigga (Dec 06)
- RE: DMZ / Firewall rule diagramming Craig Humphrey (Dec 07)
- Re: DMZ / Firewall rule diagramming Michael Gale (Dec 06)
- Re: DMZ / Firewall rule diagramming Spigga (Dec 07)
- Re: DMZ / Firewall rule diagramming Spigga (Dec 08)
- Re: DMZ / Firewall rule diagramming Michael Gale (Dec 06)
- RE: DMZ / Firewall rule diagramming aldr1c (Dec 08)
- RE: DMZ / Firewall rule diagramming Gaydosh, Adam (Dec 08)
- RE: DMZ / Firewall rule diagramming Jackson, Gary (Dec 08)
- RE: DMZ / Firewall rule diagramming Craig Humphrey (Dec 08)
- RE: DMZ / Firewall rule diagramming Craig Humphrey (Dec 08)
- RE: DMZ / Firewall rule diagramming Craig Humphrey (Dec 09)