How to Set Up a DMZ with ISA Server

Many organizations don't implement a demilitarized zone (DMZ) in their networks. Instead, they locate their public servers (e.g., Web servers) on the same internal network as the rest of the organization's servers and workstations. Without a DMZ to separate your publicly accessible servers from your internal LAN, you're exposing your internal network to added risk. When an attacker gains control of your Web server, that person can use it to attack sensitive resources (e.g., financial applications, file servers) in your internal network. Notice that I said when and not if. No matter how securely you lock down a Web server, you should count on its compromise and design your network and processes to minimize damage and ensure their quick restoration. One such strategy is compartmentalization, and one tactical component of compartmentalization is implementing a DMZ.

When you implement a DMZ, you create two physically separate networks: one network for public servers and one network for all internal servers and workstations. Depending on the type of DMZ, one or more firewalls enforce routing policies specific to each network and strictly control access between

• the Internet and the DMZ
• the Internet and the internal network
• the DMZ and the internal network

The main advantage of implementing a DMZ instead of just using a firewall is that when an attacker compromises a public server, the risk to the internal servers is reduced because the public servers and internal servers are separate from each other. When the compromised server resides in a DMZ, the attacker isn't able to directly attack other more-sensitive servers on the internal network. The firewall blocks any attempt by the DMZ computers to connect to internal computers, except for specifically allowed connections. For example, you might configure your firewall to let the Web server in the DMZ connect to an internal Microsoft SQL Server machine through a specific TCP port. If an intruder compromises the Web server, he or she might be able to attack the SQL Server machine on that port. However, the intruder won't be able to attack the SQL Server machine's other services and ports or other computers on the internal network. . . .