How secure can a screened host be?

[Bill Stout <bstout @ osc . hitachi . com>]

I have a theoretical configuration where I would like to use a screened
host, AND Cisco policy routing.  The bennies would be the ability to
firewall multiple links with one router.  My concern is the overall security
of such an arrangement in comparison to a true DMZ.

<diagram follows>

         Business partner---Router----Internal Net(s)
                            /  | \
                 Internet--/   |  \---Firewall
                               |
                          Web Server(s)

In the Cisco, the policy routing would be enabled as follows:

Interface s0/1
 description Line to Internet
 ip policy route-map firewall
 ip access-group 2 out

Interface s0/2
 description Line to Business Partner
 ip policy route-map firewall
 ip access-group 2 out
...and so on.

route-map firewall permit 10
 match ip address 1
 set ip next-hop 'firewall_IP_address'

access-list 1 permit any
access-list 2 permit 'firewall_IP_address'


Comments??


William B. Stout
Senior Systems Administrator
Hitachi Data Systems
Open Systems Center
Santa Clara, California