DMZ boxes in the domain

        We're considering adding the DMZ Win2K/IIS servers to the internal domain. This sounds like a rather dangerous thing to do, but while discussing this we came up with an idea of giving the box 2 NICs, one a DMZ address and the other an internal address and disabling all routing between the 2 NICs. Hopefully, in this scenario we can still manage the Win2K normally via the domain while permitting the box to serve out our site. If the box is compromised from the DMZ side, in theory, this wouldn't allow the compromise to affect the internal network.

     Ideas/thoughts/concerns...

All helps appreciated!! Received on Wed Feb 26 16:34:51 2003