webserver || waf || dmz zone

Hello,

Thanks for reaching out. 

Could you show your network diagram/setup and kindly confirm the expected output for this query? 

Also, could you show the FW/WAF rules you're currently using for the setup?

Thank you

Hi,

pls, find the network diagram.

webserver in DMZ zone we are applying the WAF policy in the firewall.

now, the web server we are accessing from outside/lan/vpn through FQDN( FQDN points to the public IP of waf)

backup server in the LAN zone we will do a backup of the webserver how to do backup.

Thanks 

SATYA

Hello,

Thank you for providing the diagram,

I may recommend here is that you configure the server to have redundancy instead of configuring a backup on LAN.

Always a good practice to separate your public-facing servers on your local network, so if any potential compromise happens in DMZ it lessens the surface to that zone.

But configuration-wise, I think a WAF rule below your original rule for the DMZ server would achieve what you expect (but even if this pushed through I believe it would not be a best security practice) 

Further, I may also recommend you reach out to your local Sophos Sales Engineer or Partner should you need to discuss further but I do hope my insights help you on your setup.

Hope you have a nice day and thank you for choosing Sophos. 

Regards,

Hello,

Thank you for providing the diagram,

I may recommend here is that you configure the server to have redundancy instead of configuring a backup on LAN.

Always a good practice to separate your public-facing servers on your local network, so if any potential compromise happens in DMZ it lessens the surface to that zone.

But configuration-wise, I think a WAF rule below your original rule for the DMZ server would achieve what you expect (but even if this pushed through I believe it would not be a best security practice) 

Further, I may also recommend you reach out to your local Sophos Sales Engineer or Partner should you need to discuss further but I do hope my insights help you on your setup.

Hope you have a nice day and thank you for choosing Sophos. 

Regards,