RE: DMZ Archtecture - Using public address space vs. using Private Ad dress space and NAT

["ruka +" <ruka () my-deja com>]

Another reason for using private address space+NAT is a possible future migration for another ISP. It's just a matter 
of changing the NAT rules in the firewall.

If using public addresses in the DMZ machines, you'll have to change config files, scripts using IP addresses, and only 
devil knows what  problems can surface. ;->

> "Stapleton, Bernard (Australia)" <bernard_stapleton () exchange au ml com> "'firewall-wizards () nfr com'" 
> <firewall-wizards () nfr com>Date: Thu, 2 Aug 2001 01:04:28 +0900
>
> Everyone,
>
> We have started an interesting conversation at work at the moment, regarding
> whether to use public address space in our DMZs.
>
> The idea of using public address space has its pros and cons.
>
> Pro:
>
> No address conflict with connecting to external partners. They can route
> this space internally and so can you, without fear of conflict with another
> party.
> No need for address translation / simplification of management
> Ease of passing protocols that are difficult to firewall
>
> Cons
>
> Security risk if firewall host still routes if firewall software shutdown
> More complex management
>
> I was wondering if anyone on this list has anything to say about this topic?
> I would like to know what people might be doing internally themselves, and
> why they came to that decision.
>
> Thanks
>
> Berny
>
>
>
> All opinions / arguements and anything else otherwise stated in this email
> are my own, and not of my employer.
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () nfr com
> http://list.nfr.com/mailman/listinfo/firewall-wizards




------------------------------------------------------------
--== Sent via Deja.com ==--
http://www.deja.com/
_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards