Defining Security Zones

Defining Security Zones

The basic strategy behind setting up zones is as follows:

1. The device with the greatest security needs (the private network) are within the network's most-secure zone.
2. Servers that need to be accessed only internally are put in a separate private and secure zone.
3. Servers that need to be accessed from the public network are put in a segregated zone with no access to the network's more-secure zones.

 

Designing a Demilitarized Zone

DMZ是英文"demilitarized zone"的缩写，中文名称为"隔离区"，也称"非军事化区"。它是为了解决安装防火墙后外部网络的访问用户不能访问内部网络服务器的问题，而设立的一个非安全系统与安全系统之间的缓冲区。该缓冲区位于企业内部网络和外部网络之间的小网络区域内。在这个小网络区域内可以放置一些必须公开的服务器设施，如企业Web服务器、FTP服务器和论坛等。另一方面，通过这样一个DMZ区域，更加有效地保护了内部网络。因为这种网络部署，比起一般的防火墙方案，对来自外网的攻击者来说又多了一道关卡。

 

Here are some of the most common ways of creating DMZ:

1. Using a three-legged firewall to create the DMZ
2. Placing the DMZ outside the firewall between the public network and the firewall
3. Placing the DMZ outside firewall but not in the path between the public network and the firewall (also called a 'dirty DMZ')
4. Creating a DMZ between stacked firewalls