SOT: web server in DMZ?

This is slighly out of the SBS realm, I know, but there are some very sharp
minds here....

I have a client (non-SBS) with three servers in their lan: DC, file, SQL.
They are wanting to set up a web server for an IIS-based e-commerce app that
will need to access the SQL and file servers. My question is, What is the
best way to set this up without overkill?

I'm thinking something like:


internet
|
|
dedicated
isa box ---> web server in 192.168.x.x
|
|
LAN
10.0.x.x
other servers


The IIS site on the web server will need to be remotely managed by an
outside party on occasion, (possibly by manually enabling TS through the
firewall only when req'd?) so I will need to really strip this box down
before letting anyone access it.

Can ISA be configured to allow SQL & virtual directory connections ONLY from
the web server's ip, perhaps even ONLY from IIS? Is there a better way to
do this?

Thanks!

Mark
Fri Oct 24 20:45:12 CDT 2003

If you need to tie in your IIS server and the other 2 then you are going to
be vulnerble to some degree. You need to be on top of IIS!

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Erik Cole" <erikjcole@hotmail.com> wrote in message
news:iEfmb.14835$5c2.265@okepread03...
> This is slighly out of the SBS realm, I know, but there are some very
sharp
> minds here....
>
> I have a client (non-SBS) with three servers in their lan: DC, file, SQL.
> They are wanting to set up a web server for an IIS-based e-commerce app
that
> will need to access the SQL and file servers. My question is, What is the
> best way to set this up without overkill?
>
> I'm thinking something like:
>
>
> internet
> |
> |
> dedicated
> isa box ---> web server in 192.168.x.x
> |
> |
> LAN
> 10.0.x.x
> other servers
>
>
> The IIS site on the web server will need to be remotely managed by an
> outside party on occasion, (possibly by manually enabling TS through the
> firewall only when req'd?) so I will need to really strip this box down
> before letting anyone access it.
>
> Can ISA be configured to allow SQL & virtual directory connections ONLY
from
> the web server's ip, perhaps even ONLY from IIS? Is there a better way to
> do this?
>
> Thanks!
>
>

Chad
Fri Oct 24 21:08:22 CDT 2003

Hi Erik -

Yes - you can do what you propose. I'll admit that I haven't had much
experience with using a 3rd nic DMZ in ISA - and to be honest, I don't
really like the idea. I can't offer any technical explanation - I've just
got a bad gut feeling about it. If it were me, I think I'd put a hardware
firewall/router on your perimeter (this doesn't have to necessarily be a
Cisco, but I wouldn't go with a Linksys either - something mid-range). I
would then set it up like so:

Internet
|
|
------- Router -------
| |
ISA Web Server
|
LAN -----------
| |
SQL File Server


You can then server-publish your SQL & file servers in ISA and restrict
connections to the web server's non-routable IP. In order to do this, you
will need to create a Client Address Set in ISA that includes the
non-routable IP of the web server - then when you create your server
publishing rules, you can restrict rule to only accecpt connections from
this IP.

--
Chad A Gross [SBS-MVP]

SBS ROCKS!!!

Erik Cole wrote:
> This is slighly out of the SBS realm, I know, but there are some very
> sharp minds here....
>
> I have a client (non-SBS) with three servers in their lan: DC, file,
> SQL. They are wanting to set up a web server for an IIS-based
> e-commerce app that will need to access the SQL and file servers. My
> question is, What is the best way to set this up without overkill?
>
> I'm thinking something like:
>
>
> internet
> |
> |
> dedicated
> isa box ---> web server in 192.168.x.x
> |
> |
> LAN
> 10.0.x.x
> other servers
>
>
> The IIS site on the web server will need to be remotely managed by an
> outside party on occasion, (possibly by manually enabling TS through
> the firewall only when req'd?) so I will need to really strip this
> box down before letting anyone access it.
>
> Can ISA be configured to allow SQL & virtual directory connections
> ONLY from the web server's ip, perhaps even ONLY from IIS? Is there
> a better way to do this?
>
> Thanks!

Henry
Fri Oct 24 21:18:50 CDT 2003

Put the Web Server in a DMZ

Internet
|
Quality Firewall Router
( With Stateful Packet Inspection and Logs )
| |
ISA Server Web Server
|
LAN

Talk to the folks over at:
microsoft.public.inetserver.iis
and
microsoft.public.inetserver.iis.security
as this is their specialty field.

...far better to use the appropriate forum as this topic is extensive
and not really appropriate here as running an SQL Server Backed
e'Commerce site is not supported Under SBS.

---
Henry Craven.
---------------
2b XOR 2b


"Erik Cole" <erikjcole@hotmail.com> wrote in message
news:iEfmb.14835$5c2.265@okepread03...
> This is slighly out of the SBS realm, I know, but there are some very
sharp
> minds here....
>
> I have a client (non-SBS) with three servers in their lan: DC, file,
SQL.
> They are wanting to set up a web server for an IIS-based e-commerce
app that
> will need to access the SQL and file servers. My question is, What is
the
> best way to set this up without overkill?
>
> I'm thinking something like:
>
>
> internet
> |
> |
> dedicated
> isa box ---> web server in 192.168.x.x
> |
> |
> LAN
> 10.0.x.x
> other servers
>
>
> The IIS site on the web server will need to be remotely managed by an
> outside party on occasion, (possibly by manually enabling TS through
the
> firewall only when req'd?) so I will need to really strip this box
down
> before letting anyone access it.
>
> Can ISA be configured to allow SQL & virtual directory connections
ONLY from
> the web server's ip, perhaps even ONLY from IIS? Is there a better
way to
> do this?
>
> Thanks!
>
>

Mark
Fri Oct 24 22:47:55 CDT 2003

chad,
How is his IIS going to get data from SQL and and file server behind
ISA....without opening up his whole LAN?

--
Sincerely,
Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
www.MCSE2000.com
www.AppLauncher.com



"Chad A Gross [SBS-MVP]" <chad.gross@laytonflower.nospam.com> wrote in
message news:ODb%23ezpmDHA.744@tk2msftngp13.phx.gbl...
> Hi Erik -
>
> Yes - you can do what you propose. I'll admit that I haven't had much
> experience with using a 3rd nic DMZ in ISA - and to be honest, I don't
> really like the idea. I can't offer any technical explanation - I've just
> got a bad gut feeling about it. If it were me, I think I'd put a hardware
> firewall/router on your perimeter (this doesn't have to necessarily be a
> Cisco, but I wouldn't go with a Linksys either - something mid-range). I
> would then set it up like so:
>
> Internet
> |
> |
> ------- Router -------
> | |
> ISA Web Server
> |
> LAN -----------
> | |
> SQL File Server
>
>
> You can then server-publish your SQL & file servers in ISA and restrict
> connections to the web server's non-routable IP. In order to do this, you
> will need to create a Client Address Set in ISA that includes the
> non-routable IP of the web server - then when you create your server
> publishing rules, you can restrict rule to only accecpt connections from
> this IP.
>
> --
> Chad A Gross [SBS-MVP]
>
> SBS ROCKS!!!
>
> Erik Cole wrote:
> > This is slighly out of the SBS realm, I know, but there are some very
> > sharp minds here....
> >
> > I have a client (non-SBS) with three servers in their lan: DC, file,
> > SQL. They are wanting to set up a web server for an IIS-based
> > e-commerce app that will need to access the SQL and file servers. My
> > question is, What is the best way to set this up without overkill?
> >
> > I'm thinking something like:
> >
> >
> > internet
> > |
> > |
> > dedicated
> > isa box ---> web server in 192.168.x.x
> > |
> > |
> > LAN
> > 10.0.x.x
> > other servers
> >
> >
> > The IIS site on the web server will need to be remotely managed by an
> > outside party on occasion, (possibly by manually enabling TS through
> > the firewall only when req'd?) so I will need to really strip this
> > box down before letting anyone access it.
> >
> > Can ISA be configured to allow SQL & virtual directory connections
> > ONLY from the web server's ip, perhaps even ONLY from IIS? Is there
> > a better way to do this?
> >
> > Thanks!
>
>

Chad
Fri Oct 24 23:44:58 CDT 2003

Hey Mark -

With ISA, we can server publish an internal server but restrict the source
IPs that we will accept connections from. Therefore, we can configure ISA
to only accept inbound SQL traffic on 1433 from the web server's IP. In
addition, if we put a hardware firewall/router between the webserver &
internet connection, we have the advantage of completely blocking port 1433
to the outside world as well as being able to configure ISA on only accept
1433 traffic from the web server's private non-routable IP.

That works for SQL - but I'll admit that I'm a more than a little leery
about having IIS access a file server on the LAN. No - I don't like that
idea at all, because if we enable file access the web server may as well be
on the LAN. Hopefully Erik will post back with why he needs file access
from the web server. With any luck, he'll only need static files that can
be handled via an FTP server external to the LAN.

--
Chad A Gross [SBS-MVP]

SBS ROCKS!!!

Mark Mancini wrote:
> chad,
> How is his IIS going to get data from SQL and and file server behind
> ISA....without opening up his whole LAN?
>
>
> "Chad A Gross [SBS-MVP]" <chad.gross@laytonflower.nospam.com> wrote in
> message news:ODb%23ezpmDHA.744@tk2msftngp13.phx.gbl...
>> Hi Erik -
>>
>> Yes - you can do what you propose. I'll admit that I haven't had
>> much experience with using a 3rd nic DMZ in ISA - and to be honest,
>> I don't really like the idea. I can't offer any technical
>> explanation - I've just got a bad gut feeling about it. If it were
>> me, I think I'd put a hardware firewall/router on your perimeter
>> (this doesn't have to necessarily be a Cisco, but I wouldn't go with
>> a Linksys either - something mid-range). I would then set it up
>> like so:
>>
>> Internet
>> |
>> |
>> ------- Router -------
>> | |
>> ISA Web Server
>> |
>> LAN -----------
>> | |
>> SQL File Server
>>
>>
>> You can then server-publish your SQL & file servers in ISA and
>> restrict connections to the web server's non-routable IP. In order
>> to do this, you will need to create a Client Address Set in ISA that
>> includes the non-routable IP of the web server - then when you
>> create your server publishing rules, you can restrict rule to only
>> accecpt connections from this IP.
>>
>> --
>> Chad A Gross [SBS-MVP]
>>
>> SBS ROCKS!!!
>>
>> Erik Cole wrote:
>>> This is slighly out of the SBS realm, I know, but there are some
>>> very sharp minds here....
>>>
>>> I have a client (non-SBS) with three servers in their lan: DC, file,
>>> SQL. They are wanting to set up a web server for an IIS-based
>>> e-commerce app that will need to access the SQL and file servers.
>>> My question is, What is the best way to set this up without
>>> overkill?
>>>
>>> I'm thinking something like:
>>>
>>>
>>> internet
>>> |
>>> |
>>> dedicated
>>> isa box ---> web server in 192.168.x.x
>>> |
>>> |
>>> LAN
>>> 10.0.x.x
>>> other servers
>>>
>>>
>>> The IIS site on the web server will need to be remotely managed by
>>> an outside party on occasion, (possibly by manually enabling TS
>>> through the firewall only when req'd?) so I will need to really
>>> strip this
>>> box down before letting anyone access it.
>>>
>>> Can ISA be configured to allow SQL & virtual directory connections
>>> ONLY from the web server's ip, perhaps even ONLY from IIS? Is there
>>> a better way to do this?
>>>
>>> Thanks!

Erik
Sat Oct 25 10:00:56 CDT 2003

Thanks all for the help. I'm afraid this is one of those "we bought the
software already, now help us make it work" situations. The main e-commerce
app has a Visual FoxPro database, hence the need for file access. I'm
thinking I could somehow create a single share that is locked down. But yes,
it's always more fun to make the best of a less-than-ideal situation than to
be in on the design from the start.....

"Chad A Gross [SBS-MVP]" <chad.gross@laytonflower.nospam.com> wrote in
message news:e84RALrmDHA.2000@TK2MSFTNGP12.phx.gbl...
> Hey Mark -
>
> With ISA, we can server publish an internal server but restrict the source
> IPs that we will accept connections from. Therefore, we can configure ISA
> to only accept inbound SQL traffic on 1433 from the web server's IP. In
> addition, if we put a hardware firewall/router between the webserver &
> internet connection, we have the advantage of completely blocking port
1433
> to the outside world as well as being able to configure ISA on only accept
> 1433 traffic from the web server's private non-routable IP.
>
> That works for SQL - but I'll admit that I'm a more than a little leery
> about having IIS access a file server on the LAN. No - I don't like that
> idea at all, because if we enable file access the web server may as well
be
> on the LAN. Hopefully Erik will post back with why he needs file access
> from the web server. With any luck, he'll only need static files that can
> be handled via an FTP server external to the LAN.
>
> --
> Chad A Gross [SBS-MVP]
>
> SBS ROCKS!!!
>
> Mark Mancini wrote:
> > chad,
> > How is his IIS going to get data from SQL and and file server behind
> > ISA....without opening up his whole LAN?
> >
> >
> > "Chad A Gross [SBS-MVP]" <chad.gross@laytonflower.nospam.com> wrote in
> > message news:ODb%23ezpmDHA.744@tk2msftngp13.phx.gbl...
> >> Hi Erik -
> >>
> >> Yes - you can do what you propose. I'll admit that I haven't had
> >> much experience with using a 3rd nic DMZ in ISA - and to be honest,
> >> I don't really like the idea. I can't offer any technical
> >> explanation - I've just got a bad gut feeling about it. If it were
> >> me, I think I'd put a hardware firewall/router on your perimeter
> >> (this doesn't have to necessarily be a Cisco, but I wouldn't go with
> >> a Linksys either - something mid-range). I would then set it up
> >> like so:
> >>
> >> Internet
> >> |
> >> |
> >> ------- Router -------
> >> | |
> >> ISA Web Server
> >> |
> >> LAN -----------
> >> | |
> >> SQL File Server
> >>
> >>
> >> You can then server-publish your SQL & file servers in ISA and
> >> restrict connections to the web server's non-routable IP. In order
> >> to do this, you will need to create a Client Address Set in ISA that
> >> includes the non-routable IP of the web server - then when you
> >> create your server publishing rules, you can restrict rule to only
> >> accecpt connections from this IP.
> >>
> >> --
> >> Chad A Gross [SBS-MVP]
> >>
> >> SBS ROCKS!!!
> >>
> >> Erik Cole wrote:
> >>> This is slighly out of the SBS realm, I know, but there are some
> >>> very sharp minds here....
> >>>
> >>> I have a client (non-SBS) with three servers in their lan: DC, file,
> >>> SQL. They are wanting to set up a web server for an IIS-based
> >>> e-commerce app that will need to access the SQL and file servers.
> >>> My question is, What is the best way to set this up without
> >>> overkill?
> >>>
> >>> I'm thinking something like:
> >>>
> >>>
> >>> internet
> >>> |
> >>> |
> >>> dedicated
> >>> isa box ---> web server in 192.168.x.x
> >>> |
> >>> |
> >>> LAN
> >>> 10.0.x.x
> >>> other servers
> >>>
> >>>
> >>> The IIS site on the web server will need to be remotely managed by
> >>> an outside party on occasion, (possibly by manually enabling TS
> >>> through the firewall only when req'd?) so I will need to really
> >>> strip this
> >>> box down before letting anyone access it.
> >>>
> >>> Can ISA be configured to allow SQL & virtual directory connections
> >>> ONLY from the web server's ip, perhaps even ONLY from IIS? Is there
> >>> a better way to do this?
> >>>
> >>> Thanks!
>
>

Mal
Mon Oct 27 05:47:01 CST 2003

Not so much "unsupported" as "outside of the licensing terms". If you want
to back-end IIS with SBSs SQL server, you need to purchase a processor
licence. These aint cheap!

Mal Osborne
MCSE MVP Mensa


"Henry Craven" <IUnknown@d.com> wrote in message
news:%23XbUF4pmDHA.964@TK2MSFTNGP10.phx.gbl...
> Put the Web Server in a DMZ
>
> Internet
> |
> Quality Firewall Router
> ( With Stateful Packet Inspection and Logs )
> | |
> ISA Server Web Server
> |
> LAN
>
> Talk to the folks over at:
> microsoft.public.inetserver.iis
> and
> microsoft.public.inetserver.iis.security
> as this is their specialty field.
>
> ...far better to use the appropriate forum as this topic is extensive
> and not really appropriate here as running an SQL Server Backed
> e'Commerce site is not supported Under SBS.
>
> ---
> Henry Craven.
> ---------------
> 2b XOR 2b
>
>
> "Erik Cole" <erikjcole@hotmail.com> wrote in message
> news:iEfmb.14835$5c2.265@okepread03...
> > This is slighly out of the SBS realm, I know, but there are some very
> sharp
> > minds here....
> >
> > I have a client (non-SBS) with three servers in their lan: DC, file,
> SQL.
> > They are wanting to set up a web server for an IIS-based e-commerce
> app that
> > will need to access the SQL and file servers. My question is, What is
> the
> > best way to set this up without overkill?
> >
> > I'm thinking something like:
> >
> >
> > internet
> > |
> > |
> > dedicated
> > isa box ---> web server in 192.168.x.x
> > |
> > |
> > LAN
> > 10.0.x.x
> > other servers
> >
> >
> > The IIS site on the web server will need to be remotely managed by an
> > outside party on occasion, (possibly by manually enabling TS through
> the
> > firewall only when req'd?) so I will need to really strip this box
> down
> > before letting anyone access it.
> >
> > Can ISA be configured to allow SQL & virtual directory connections
> ONLY from
> > the web server's ip, perhaps even ONLY from IIS? Is there a better
> way to
> > do this?
> >
> > Thanks!
> >
> >
>
>

Henry
Tue Oct 28 19:16:34 CST 2003

Perhaps I should have worded that differently.

- running an SQL Server Backed e'Commerce site is not legally supported
Under SBS 2000 when using the SQL Server provided with SBS 2000.

** Note that it has now been confirmed that in SBS 2003 Premium, the SQL
Server -can- be used to backend a public website.

Quote:
"Windows Small Business Server 2003, Premium Edition, includes Microsoft
SQL ServerT 2000. Businesses running the premium edition can now
establish an interactive Web presence with an unlimited number of
visitors and can run as many business applications as they need. Note
Access to Web applications based on Small Business Server 2000/SQL
Server 2000 was limited to 50 concurrent sessions. This limitation has
been removed with Windows Small Business Server 2003, Premium Edition."

.....it may be another matter if the "Visitors" need to "Authenticate".
( still trying to work that one out )

---
Henry Craven


"Mal Osborne" <malcolmo@silverfern.com.au> wrote in message
news:uwNZ9zanDHA.2444@TK2MSFTNGP09.phx.gbl...
> Not so much "unsupported" as "outside of the licensing terms". If you
want
> to back-end IIS with SBSs SQL server, you need to purchase a processor
> licence. These aint cheap!
>
> Mal Osborne
> MCSE MVP Mensa