My best Option??

I have a windows 2003 server sitting on my DMZ. Single
Nic. Lets say its 172.20.1.10. I want to create a share on
it, that a few people on my internal network can access.
My internal network is a 10.20.1.x.

Now I have a server running windows 2000 advanced and it
has dual nics, 1 nic on my dmz and 1 on my internal nic.
Its my unit that does my back-ups and sees both networks
no problem.

Now what would be the easiest way to access a share on my
2003 server sitting on the DMZ from my internal network?
Could I route trough my 2000 advanced server or should i
mess with my firewall?

Anyone...explain what you think i should do.

On Tue, 31 Aug 2004 13:07:56 -0700, "josh"
<(E-Mail Removed)> wrote:

>I have a windows 2003 server sitting on my DMZ. Single
>Nic. Lets say its 172.20.1.10. I want to create a share on
>it, that a few people on my internal network can access.
>My internal network is a 10.20.1.x.
>
>Now I have a server running windows 2000 advanced and it
>has dual nics, 1 nic on my dmz and 1 on my internal nic.
>Its my unit that does my back-ups and sees both networks
>no problem.
>
>Now what would be the easiest way to access a share on my
>2003 server sitting on the DMZ from my internal network?
>Could I route trough my 2000 advanced server or should i
>mess with my firewall?
>
>Anyone...explain what you think i should do.

You have two routes between your DMZ and LAN. That means you have to
secure both of them from attack. That doubles your chances of a
mistake, as well as doubles the attack vector. You should *never*
bypass the firewall as you've done with your backup system.

Jeff

"Jeff Cochran" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> >Now what would be the easiest way to access a share on my
> >2003 server sitting on the DMZ from my internal network?
> >Could I route trough my 2000 advanced server or should i
> >mess with my firewall?

The best way is to not do it at all. "Shares" are for LANs, not for DMZs.

Use FTP to work with the files. You would connect to it with FTP just as you
would any machine on the Internet from the LAN. Even FTP isn't the most
secure thing in the world, but it is certainly better than what you are
proposing.

Your backup design is also a problem as Jeff indicated. You should install
a Tape Drive in the machine itself and do backups locally with its own tape
drive.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com