topic Re: Gateway Topolgy - Internal, External or DMZ ? in General Topics

Gateway Topolgy - Internal, External or DMZ ?

bad_joojoo — Tue, 18 Apr 2023 08:09:05 GMT

Hi all,

Just looking at a scenario and asked a question around the correct "Topology" for interfaces connecting to other manufacturer firewalls. In this scenario, CP Gateway is the Internal firewall protecting the hosted Data Centres. There are links to other firewalls which provide ongoing connectivity to the varying customers networks, and links to similar with a DMZ hosting proxy services (Web, Email, etc).

My question is, should the interconnecting links be consider Internal, DMZ or External?

Cheers

Re: Gateway Topolgy - Internal, External or DMZ ?

Chris_Atkinson — Thu, 20 Apr 2023 23:25:22 GMT

When making these decisions it's important to understand what these settings influence as relevant to what controls the gateway is enforcing. Provided below are some of the relevant resources for review:

SmartConsole R81.20 Help - Understanding Topology

sk108057: What does the box "Interface leads to DMZ" control in interface topology?

sk108057: How to configure the Protected Scope in Anti-Virus Settings for file downloads

sk64543: Topology and "Internet" object in Application and URL Filtering rule base

sk102675: When using "Internet" object as destination in Application Control rule to block an application, traffic sent to DMZ blocked

Re: Gateway Topolgy - Internal, External or DMZ ?

the_rock — Wed, 19 Apr 2023 02:42:31 GMT

To me, logically, I would say DMZ, based on your diagram.

Re: Gateway Topolgy - Internal, External or DMZ ?

PhoneBoy — Thu, 20 Apr 2023 23:03:58 GMT

External should used for interfaces that can be used to reach the Internet (i.e. it has the default route).
Which means your interface pointing towards the upper Palo (which has the Internet connected) should be marked as external.
The interface pointing towards the customer networks can be marked as a DMZ.

Re: Gateway Topolgy - Internal, External or DMZ ?

bad_joojoo — Fri, 21 Apr 2023 07:23:26 GMT

Many thanks all for your replies, Kind Regards Ju