I'm wondering just what class of attack scenarios is
thought to be prevented by dual-porting the DMZ
systems, thus:
|---DMZ sys---|
| |
| |
| |
outer | | inner
boundary-----|---DMZ sys---|----boundary
router | | router
| |
| |
|---DMZ sys---|
As opposed to:
|---DMZ sys
|
|
|---DMZ sys
outer | inner
boundary-----|-----------------boundary
router | router
|
|---DMZ sys
The only thing I can think of that the first one gives you
and the second one doesn't, is protection against some subversion
of the outer boundary router. Are there other benefits that
I've overlooked?
--Michael Smith
ms @
gf .
org
|
|
