Re: Maximum number of subnets on a firewall

[Chuck Swiger <chuck () codefab com>]

Paolo Supino wrote:
>   The following story and question aren't product specific so please don't
> try to attach it to any available product: I was asked to plan a network for
> a group of 3 companies (all located in the same building and want to use the
> same infrastracture). From gathering the requirements of each of the
> companies I've concluded that all of them together will need 10 subnets
> (including the subnet that is connected to the internet). Since the biggest
> number of subnets per firewall that I ever installed was 6. Setting up 10
> subnets on 1 firewall (to me) seems too much for me so I'm looking for a way
> to have the 10 networks on 2 (or 3) different firewalls. If you have any
> suggestions on a possible layout I'd be very happy to read it.

Frankly, unless two companies really trust each other and have the same 
security policy, they should not attempt to share a firewall, and of course, 
you want something between your upstream network connection(s) and your shared 
DMZ infrastructure zone.

At the least, this means you should be looking at:

inet1 ---->  +-----+               +-----+ <===> [ Company A subnet 1], [A2]
             | fw1 | <===[DMZ]===> | fw2 | <===> [ Company B1 ], [B2], ...
inet2 ---->  +-----+               +-----+ <===> [ C1 ], [C2], ...

Otherwise, add another one or two firewalls for company B or C:

                       |       |
                       V       V
                    [ fw3 ] [ fw4 ]

...attached to the DMZ, as well.  Your DMZ could be as simple as a 4-port hub 
or switch, or you could put shared resources like nameservers, mailservers, a 
web proxy server, etc.

--
-Chuck

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards