>The problem either way is that cracker just needs to subvert the bastion
>host. Even with a screening router the bastion host is visible to the
>outside world, or it wouldn't be reachable. I'm not convinced that
>putting the bastion host inside the screening router is better and I
>think that it may in fact be worse.
However, by putting the Bastion behind an ACLed router, you can limit the
forms of attack that can take place on the Bastion, impossible if
the Bastion is in front of the router. If subverted, the information on
the Bastion can provide information on how to get past the router while the
reverse is not true (Particularly if all the router knows is how to get to
the Bastion).
IMHO put the dumbest device out front, it will be the least informative if
corrupted.
Warmly,
Padgett
|
|
