Re: DMZ design - Exchange, SQL, & DCOM

[Mikael Olsson <mikael.olsson () enternet se>]

Jan Schultheiss wrote:
> Mikael Olsson wrote:
> > The reason for the separate DMZ is that you don't want to expose
> > your mail forwarder to your web server.
>
> Another possibility is to use "secure" switches. There is a switch from Bay
> (i.e Nortel) that allows you to configure on a port basis which devices are
> allowed to talk to each other. 

Yes, this would work.

But does your switch do logging and alerting when your web
server tries to hack your mail server?

It'd be damn nice to see evidence of when you're web server
has been hacked so you know when to go reformat and reinstall
it:-) (And, hopefully, see what the hell went wrong and secure it)

/Mike

-- 
Mikael Olsson, EnterNet Sweden AB, Box 393, S-891 28 ÖRNSKÖLDSVIK
Phone: +46 (0)660 105 50           Fax: +46 (0)660 122 50
Mobile: +46 (0)70 248 00 33
WWW: http://www.enternet.se        E-mail: mikael.olsson () enternet se