0

My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers

Servers in DMZ- Webserver (Company Website), Proxy

Servers in the internal Network - Messaging (Exchange) and Authentication and Domain Services (AD)

Now I have only one SAN setup which I should share between those two networks.

Is connecting the SAN to both the servers in the DMZ and the internal Network a Sin in Network Security Context ?

Whats the best practice ?

Vivek Bernard
  • 143
  • 9

2 Answers2

2

Since the SAN is a separate infrastructure, as long as you zone separate LUNs to separate locations, it should not be a horrible problem.

However, usually a SAN is the placeholder for all the sensitive data in the organization, and it is best to keep it as secure as possible, preferrably accessible only internally, by firewall protected servers

dyasny
  • 18,802
  • 6
  • 49
  • 64
2

You don't mention what type of SAN you're thinking of, certainly I'd be a lot happier using an FC-attached SAN between systems in two different security zones as an intruder would have to hack the IP aspect of your web server, then hack an FC array - two totally different skills/protocols etc. - to get at the internal data. Also FC networks tend to be based around effectively point-to-point connections unlike 'regular' IP networks where things are open to all unless tied down. Conversely if you can crack a web server then you probably have the skills to go poking around over iSCSI, even if it's on a dedicated subnet.

Chopper3
  • 101,299
  • 9
  • 108
  • 239
  • Ok so, is it possible to have the SAN storage and the servers (which will use the SAN storage) in a different subnet i.e route the iSCSI traffic through a router ? – Vivek Bernard Mar 07 '11 at 14:35
  • It's all *possible*, none of this is hard, you just need to look at your security requirements and figure out how important that security is. If security is **paramount** then it'd be worth splitting out the storage completely, if it's of less concern then perhaps simply putting into two/four interfaces from your SAn box might make sense (i.e. 1 or 2 physical links going to DMZ/web and 1/2 links going to internal/app layer). – Chopper3 Mar 07 '11 at 14:47