Re: Web Server Network Setup Questions -- WEB400

In the setup you describe, I'm sure you can configure the Cisco so itwill route one port from the Internet to the iSeries, This will be theeasiest an more efficient way to be able to serve info from theiSeries. Direct and simple.The down is that "purists" may object the fact that a computer in theinternal network can be accessed fron Internet.If your iSeries has two network cards you can put one in the intenal netand the other in the DMZ.Other setups, like two firewalls or some bridge or firewall between yourweb server and your iSeries will just add complexity, reduce speed, costmore, be more prone to fail, etc. but will add no real security, worst:it may be even more fragil than an IP forwarding in the Cisco.

_________________________________________________________________________________________________
Tom Jedrzejewicz wrote:

I get the feeling that the people making those decisions don't really know
what they are doing.  If the internal network is already connected to the
internet, getting a separate  internet connection for the web server buys no
added security.

A simplified version of our setup.  We have a firewall (a Cisco Pix) with 3
network cards.

The "outside" interface is connected to the internet.
The "inside" interface is connected to the internal network
The third interface with a random name is connected to a "DMZ" network.

Rules allow ...
- the internet access to the DMZ for http and https
- the internet access to the mail server for smtp
- the inside access to the internet and the DMZ
- the DMZ access was specifically configured -- the specific DMZ addresses
are given access to the specific inside servers and the specific ports
necessary.

The setup suggested by Mr. Jones is another good option; my preference is to
have one more complicated firewall rather than two simple firewalls.  The
Pix we use is relatively pricey.  SonicWall makes good firewalls for less $;
we have one at another site and it works well.  There are also open source
firewalls (i.e. http://www.smoothwall.org/).


On 8/23/06, Mike <koldark@xxxxxxxxx> wrote:

While this may not be a usual forum for this, this IS iSeries related. I
am
just querying the others out here how they do it.

We have been using an outside vendor for web hosting and are just now
going
to be bringing our web site in-house. From what I understand (I just
jumped
in) there will be a seperate line for the web server (Windows 2003) than
our
regular internet connection to keep things out of the internal network.
However, we want to do a bunch of stuff with our iSeries data (mostly
inquiry) which of course is in the internal network. How have you setup
your
connection for things like this? We have ideas, but have no idea what
works
best in practice.

--
Mike Wills
http://mikewills.name - Blog