ISP/VLAN/Firewall Security

[AndyB]

Guys,

This is not strictly a checkpoint issue but more of a secuirty concern. We have just changed to a new ISP which has now been delivered. However, our network engineer on site as patched the ISP internet feed into our DMZ on a sperate VLAN and from the VLAN patched to the external interface of our firewall, there is also a Cisco ASA connected to this VLAN for a joint venture project. My question is, would this be a valid configuration and is there any secure concerns? it seems to expose our DMZ although seperated by the VLAN. This is the first I have come across this kind of set-up, usually the internet feed is patched straight into the firewalls external interface.

Would be grateful for any advise

Andy

[MarioL]

If everything is properly configured it shouldn't be a problem, but to be honest I myself prefer physical separation and I would always push for that.

[mcnallym]

Shouldn't be a problem however personally I always feel better when the external link goes into a seperate switch rather then a VLAN on a DMZ switch.

It is just a comfort effect for me rather then any real must have.

[AndyB]

Guys,

Thanks for your imput. I must agree, I am a little uneasy with this set-up and would prefer the physical seperation. I will voice my concerns from a security perspective and see what response I get back.

Again, thanks