Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 38 subscribers
  • Views 10555 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Will a Web Filtering Profile (limiting time of Social Networking) work on the DMZ as it does on the LAN?

chasster123

Splitting a facility (one location, two buildings, one SG135w) across LAN and DMZ.

More secure traffic on the DMZ.

Have working a Social Media filter on the LAN.

Will this same style filter work on the DMZ as it does not seem to have affect on the DMZ at this time (cloned the process to point to DMZ instead of LAN).

CS



This thread was automatically locked due to age.
  • 0

    Chasster123,

    Policy rule can be applied on any zone and traffic is filtered. So you can filter social media from DMZ to WAN. Also for security reason, hosts in DMZ should have access to only website used to update servers content and not used for surfing on internet.

  • 0 in reply to lferrara

    Understand.

    Likely I need to address the two-building split differently.

    Perhaps put building 1 on the LAN and building 2 on another ETH port (maybe 4).

    I think in that mode (not using the purpose of the DMZ) access to the Domain server will be OK even with the LAN and ETH4 being on separate subnets.

    cs

    Charles Sterling CISSP

  • 0 in reply to chasster123

    If you want to have them in different subnet, it is a good solution. The alternative is to connect both building using different ethernet ports and create a bridge. The bridge then belogs to zone LAN.

    For security prospective, use VLAN or different subnet is the best way.

  • 0 in reply to lferrara

    Could not get the Web filtering to function on the DMZ so setting up ETH4 as the second path.

    I think this method is better in this case as these two subnets sharing the Domain Server should be less of an issue versus breaking the DMZ somewhat to get traffic flowing back to the LAN (domain and antivirus updates).

    cs

    Charles Sterling CISSP

  • 0 in reply to chasster123

    Domain server should be on separate VLAN or subnet. In this way XG can filter traffic and use advanced engine (AV, IPS, etc..) to protect domain servers from attacks coming from clientside.

    This is the best way to achieve security. It requires rules and more overhead but at least you control traffic from/to servers.

  • 0 in reply to lferrara

    Agreed.

    This process is also means of educating Single Server SMB's that they should spend appropriately for a proper design.

    Thanks.

    cs

    Charles Sterling CISSP

Unfiltered HTML