Dual NIC Card - Question

Hello's,
I'm in the process of setting up a seperate Backup Traffic LAN. I have
installed a 2nd NIC on each of my servers for backup traffic.
I have a security concern. Some of the servers are in the DMZ. Does the 2nd
NIC pose a security risk where traffic could move from one NIC onto the 2nd
NIC? How do you prevent traffic from being routed between the 2 NIC's? I have
Win2k & Win 2003 servers.

Many thanks for your time.

Blue.

Yes there is a security hole there. Traffic will not route from NIC to NIC
(assuming you don't have routing on), however you've compromised your
internal network by connecting it via the 2nd NIC to your DMZ network. You
could put a firewall in between your DMZ and the internal network and adjust
your route table in the servers.

"Bluehades" <(E-Mail Removed)> wrote in message
news:6A600869-7D76-49FB-AC39-(E-Mail Removed)...
> Hello's,
> I'm in the process of setting up a seperate Backup Traffic LAN. I have
> installed a 2nd NIC on each of my servers for backup traffic.
> I have a security concern. Some of the servers are in the DMZ. Does the
2nd
> NIC pose a security risk where traffic could move from one NIC onto the
2nd
> NIC? How do you prevent traffic from being routed between the 2 NIC's? I
have
> Win2k & Win 2003 servers.
>
> Many thanks for your time.
>
> Blue.

I guess the question then is how do you prevent routing between 2 NIC's on
win2k & win2003 servers? I seem to remember in NT4 a checkbox that could
enable or disable routing between the NICs.
Any ideas?

A.

"Neteng" wrote:

> Yes there is a security hole there. Traffic will not route from NIC to NIC
> (assuming you don't have routing on), however you've compromised your
> internal network by connecting it via the 2nd NIC to your DMZ network. You
> could put a firewall in between your DMZ and the internal network and adjust
> your route table in the servers.
>
> "Bluehades" <(E-Mail Removed)> wrote in message
> news:6A600869-7D76-49FB-AC39-(E-Mail Removed)...
> > Hello's,
> > I'm in the process of setting up a seperate Backup Traffic LAN. I have
> > installed a 2nd NIC on each of my servers for backup traffic.
> > I have a security concern. Some of the servers are in the DMZ. Does the
> 2nd
> > NIC pose a security risk where traffic could move from one NIC onto the
> 2nd
> > NIC? How do you prevent traffic from being routed between the 2 NIC's? I
> have
> > Win2k & Win 2003 servers.
> >
> > Many thanks for your time.
> >
> > Blue.
>
>
>

Have you tried routing without anything enabled that is related to Routing
and remote access. (RRAS) if you keep this service disabled you will see
there are no packets routed through this server.

good luck,

Eric Denekamp


> I guess the question then is how do you prevent routing between 2
> NIC's on
> win2k & win2003 servers? I seem to remember in NT4 a checkbox that
> could
> enable or disable routing between the NICs.
> Any ideas?
> A.
>
> "Neteng" wrote:
>
>> Yes there is a security hole there. Traffic will not route from NIC
>> to NIC (assuming you don't have routing on), however you've
>> compromised your internal network by connecting it via the 2nd NIC to
>> your DMZ network. You could put a firewall in between your DMZ and
>> the internal network and adjust your route table in the servers.
>>
>> "Bluehades" <(E-Mail Removed)> wrote in message
>> news:6A600869-7D76-49FB-AC39-(E-Mail Removed)...
>>
>>> Hello's,
>>> I'm in the process of setting up a seperate Backup Traffic LAN. I
>>> have
>>> installed a 2nd NIC on each of my servers for backup traffic.
>>> I have a security concern. Some of the servers are in the DMZ. Does
>>> the
>> 2nd
>>
>>> NIC pose a security risk where traffic could move from one NIC onto
>>> the
>>>
>> 2nd
>>
>>> NIC? How do you prevent traffic from being routed between the 2
>>> NIC's? I
>>>
>> have
>>
>>> Win2k & Win 2003 servers.
>>>
>>> Many thanks for your time.
>>>
>>> Blue.
>>>

If RRAS is configured, you control IP routing from there. If RRAS is not
configured (or you are using a workstation OS which doesn't support RRAS)
you control it with a registry setting in TCP/IP parameters.. It is off by
default. W2k/2k3 does not have an enable IP routing switch like NT.

Eric Denekamp wrote:
> Have you tried routing without anything enabled that is related to
> Routing and remote access. (RRAS) if you keep this service disabled
> you will see there are no packets routed through this server.
>
> good luck,
>
> Eric Denekamp
>
>
>> I guess the question then is how do you prevent routing between 2
>> NIC's on
>> win2k & win2003 servers? I seem to remember in NT4 a checkbox that
>> could
>> enable or disable routing between the NICs.
>> Any ideas?
>> A.
>>
>> "Neteng" wrote:
>>
>>> Yes there is a security hole there. Traffic will not route from NIC
>>> to NIC (assuming you don't have routing on), however you've
>>> compromised your internal network by connecting it via the 2nd NIC
>>> to your DMZ network. You could put a firewall in between your DMZ
>>> and the internal network and adjust your route table in the servers.
>>>
>>> "Bluehades" <(E-Mail Removed)> wrote in message
>>> news:6A600869-7D76-49FB-AC39-(E-Mail Removed)...
>>>
>>>> Hello's,
>>>> I'm in the process of setting up a seperate Backup Traffic LAN. I
>>>> have
>>>> installed a 2nd NIC on each of my servers for backup traffic.
>>>> I have a security concern. Some of the servers are in the DMZ. Does
>>>> the
>>> 2nd
>>>
>>>> NIC pose a security risk where traffic could move from one NIC onto
>>>> the
>>>>
>>> 2nd
>>>
>>>> NIC? How do you prevent traffic from being routed between the 2
>>>> NIC's? I
>>>>
>>> have
>>>
>>>> Win2k & Win 2003 servers.
>>>>
>>>> Many thanks for your time.
>>>>
>>>> Blue.