Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 17 subscribers
  • Views 4769 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

gateway deployment architecture

Dimitri Zuodar

ref sophos training ZTNA pages 31 & 32

I am interested in community feedback about the 2 mentioned deployments in the training material:

page 31: direct internet connection on gateway external nic --> I feel this should not be recommended as an architecture, the public facing interface should be secured by fw services (ddos, allow only specific inbound ports)

page 32: gateway internal nic --> for me a minimum requirement would be to have this interface also firewalled, allowing only requests from gateway to internal services to pass (dns, http(s) to published web services, ...), who else will protect your internal network in case the ztna gateway gets breached.

so to summarize, I would only recommend following architecture:



This thread was automatically locked due to age.
  • 0

    Thanks for your feedback.

    Its about the concept and the architecture. In ZTNA concepts, there is something called SPA (Single packet authentication). This will make the ZTNA GW invisible for scanner and other techniques, as it only answer to a particular interface. Its not in the product in the EAP, but something important for the future to know. 

    The concept of the page 31 is more likely to be referenced to used in cloud technologies - i guess. In cloud technologies, its much more easier to attach a public IP to a ZTNA GW (any resource). To give the ZTNA GW a on premise IP, you have to bridge it to the ISP bridge. Most customer wont do this. 

    __________________________________________________________________________________________________________________

Unfiltered HTML