Good network architecture References:

Good network architecture References:

Post by Don Lo » Mon, 27 May 2002 23:42:38









> With your situation you want two IPs for the gateway, one from LAN
> subnet and the other the DMZ subnet.  Having them both from the same
> network means that routing won't work as normal so you effectively have
> to turn the router into a bridge which means the separation isn't
> there.

> Your correct in your thinking that the NAT process won't be involved
> from LAN to DMZ

Let's say I have 2 subnets (LAN and DMZ). I'm on one of the PCs on the
internal LAN and I send out a packet designated for a machine on the
internet. First the packet is routed thru the gateway/*firewall. As the
packet passes across the DMZ, its source address is unchanged. Only when it
hits the second gateway/router is NAT performed, so that the packet now has
the gateway/router's external IP address (assigned from the ISP in this
case). In this case, NAT is performed only once on the external router, and,
as you say, the NAT process won't be involved from LAN to DMZ.

According to the author, however, "the LAN would be NATed and would not be
assigned routable addresses." This means, NAT would be performed twice. Is
there some advantage, from a security perspective, in performing NAT twice,
rather than routing the address thru the first *firewall (between LAN
and DMZ subnets) and NATing only on the external gateway/firewall?
Furthermore, if the LAN is NATed, does this mean I only need one network
for the LAN and DMZ, or can I still subnet the two?

Thanks again,

Mark

 
 
 

1. Any recommendations for good Sun architecture reference

I am digging into Sun device architecture a little deeper than I have
had to in the past (getting a FC RAID array and filesystems set up),
and I am still finding Sun's system architecture, particularly in
regards to device naming more than a bit confusing.  Can anyone point
me towards a good book on Sun architecture and devices?

Thanks much.  These groups and it's participants have been a
lifesaver!

Hal

-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----==  Over 80,000 Newsgroups - 16 Different Servers! =-----

2. Sr. UNIX Systems Administrator Needed-Mlps, MN

3. Good network architecture

4. 5634BTS Modem?

5. SPARC architecture reference

6. Use of CONFIG_M686

7. Getting good performance out of the POWER architecture

8. how can i upgrade my pc

9. BOOK: Any good books on Client/Server Design Architectures

10. BOOK: Any good books on Client/Server software Design Architectures

11. What are difference between Monolithic kernel architecture & Microkernel architecture

12. Looking for good NFS reference