Very Computer

I have the following network and I was wishing some comments on it's
IP schema.
The IPs (except for office and DMZ) correspond to NICs as well as an
outside IP for a serial card on a cisco router.

Internet ISP Gateway [x.x.x.d1]

|
---> Cisco Router [x.x.x.d2 (outside IP ) | y.y.y.d1 (inside IP)]

|
---> OBSD FW [ y.y.y.d2 (out IP) | (192.168.1.1,192.168.2.1) (2 in
IPs)]

|
---> (192.168.1.x (DMZ), 192.168.2.x (office) ]

 That is the OBSD takes the ethernet connection from the cisco router
 and communicates with 2 sub-networks. The x.x.x and y.y.y are
Internet
 addressable IPs.

 Should I consider using only the outside IP address of the Cisco
router
 as the only internet addressable address in such a system and if so,
 how do I go about assigning IPs in the network which would be more
apt?
 My naive sense of security is telling me the less internet
addressable
 IPs in your system, the better this is for system security.

 Thanks for any comments or suggestions or related links

 Mike

Quote:> I have the following network and I was wishing some comments on it's
> IP schema.
> The IPs (except for office and DMZ) correspond to NICs as well as an
> outside IP for a serial card on a cisco router.

> Internet ISP Gateway [x.x.x.d1]

> |
> ---> Cisco Router [x.x.x.d2 (outside IP ) | y.y.y.d1 (inside IP)]

> |
> ---> OBSD FW [ y.y.y.d2 (out IP) | (192.168.1.1,192.168.2.1) (2 in
> IPs)]

> |
> ---> (192.168.1.x (DMZ), 192.168.2.x (office) ]

>  That is the OBSD takes the ethernet connection from the cisco router
>  and communicates with 2 sub-networks. The x.x.x and y.y.y are
> Internet
>  addressable IPs.

>  Should I consider using only the outside IP address of the Cisco
> router
>  as the only internet addressable address in such a system and if so,
>  how do I go about assigning IPs in the network which would be more
> apt?
>  My naive sense of security is telling me the less internet
> addressable
>  IPs in your system, the better this is for system security.

>  Thanks for any comments or suggestions or related links

>  Mike

It depends what you need/use the Cisco for. It seems like you have the Cisco
there to create a DMZ, if that's the case then you probably want to leave it
as is. If however, you have, say, a web server, or other service that can
sit behind a firewall you might be better off getting rid of the cisco
entirely, putting a third internal subnet in the OBSD box (in order to
isolate the servers from your office network) and put server(s) there. Thus
you don't have to worry about hardening an entire server for the www, just
the services it exposes. Of course, if you need the DMZ for something... all
this is useless. =)

Ed