Re: Router Packet Filtering and Firewalls

Sean Smith wrote:

>As far as the ISP being lazy... Even though they say
I HIGHLY recommend the screened subnet idea. This provides an environment for you to place any IDS or other security and monitoring systems you may eventually need. It also creates a better level of diversity in depth to your security strategy, especially if there is diversity in the setup of your filtering routers and firewall (i.e. different OS's, security mechanisms, etc.).

Additionally if you decide to offer public servers at some point, the screened subnet is the obvious place to put them. These may include email servers, Jabber servers, web servers (if you have the bandwidth), etc. You may not have these now, but allowing for the addition of them later may be good, becuase it forces you to build a better, more secure, and more extensible architecture for your security.

Best Wishes,
Chris

>
>
Received on Fri Jan 31 19:29:49 2003