Re: Internet security and the AS/400 -- MIDRANGE-L

Greetings from NYC,

You are going to get a lot of different opinions here.

My experience is probably typical.

Initially, my client was hooked up for e-mail only via dial-in access to
an ISP. Then, they added a dedicated leased 56kbps link primarily for mail
access. A router, belonging to the ISP, was installed, and configured to
block incoming access to all but the known IP addresses of at-home users,
etc.

As life progressed, managing that router became too much of a headache, and
too restrictive. An AltaVista firewall was installed, and this proved to
be both a help (improving security and locally manageable) and a huge
headache (as you will discover).

The client also needed to have smart-cards for telnet access over the inet,
and tunneling software (again, AltaVista was chosen) to allow access to the
LAN behind the firewall.

All-in-all, a necessary evil for life in the late nineties. You will discover
what a royal pain any firewall is, if you are used to direct connection to
the internet without one. That is the idea, basically. You will want to
have a machine (pc) on the outside of the firewall to do certain tasks
that are difficult to impossible behind the firewall, but you must secure
that machine very well, for obvious reasons. Both physical security, so
that your user's can't use it; and complete security on the machine.

Just my 2 cents. Hire a professional to help you through this unless you
have a tiny budged and a year's worth of free time.


><Hello Everybody,
><
><I know there has been some discussion of this in the past.  However, I would
><appreciate it if I could trouble you again with a few questions.
><
><I am setting up a dedicated connection to the internet at my office via
><ISDN.  I'm going to route the internet connection directly onto my ethernet
><so that everyone on the ethernet will have access to the internet.  However,
><I want to protect my AS/400 which is also connected to the ethernet.  Also,
><I am planning to eventually use the AS/400 as an e-mail server and possibly
><HTML server in the future.  I am presently considering buying a fiewall to
><protect the entire ethernet.  What other considerations do I need to
><entertain and will a firewall be enough?  How safe will it be to allow
><telnet/ftp access to my home users (the only users will probably be MIS for
><now)?
><
><I could use suggestions on firewall brands too.  What kind of experiences
><have you had, good or bad?
><
><Thank you,
><
><
><Jack Mullins
><Sun Industries, Inc.
><2409 Industrial Dr.
><Jonesboro, AR 72401
><http://www.sundash.com
><
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---