1

Company I am consulting to wants to move all their servers from private IP space to public IP space. I'm am trying to convince them that this is a bad idea that it makes sense to move only certain servers but not internal services such as Active Directory, Internal databases, etc. According to their network guru's the servers will be secured based on the use of firewalls and IPS/IDS devices. Am I wrong in saying that this is will not be enough?

Improve this question
1
  • You're wrong that it's not enough, but it is arguably less secure due to increased chances of a misconfiguration leading to otherwise assumed inaccessible systems suddenly being internet facing. Do the advantages of having a public IP assigned outweigh these risks?
    – deed02392
    Commented Oct 30, 2013 at 13:52

1 Answer 1

Reset to default
1

A properly configured firewall protecting routeable addresses provides equivalent security to the de facto firewalling provided by NAT. There may be a slightly greater risk of holes opened up by misconfiguration with routeable addresses, but as the old saying goes, "Nothing is foolproof, because fools are so ingenious."

You'll want to examine assumptions - what advantage do they think this will provide them? Are they sure they can get the number of addresses needed to cover their systems? But your concerns that routeable firewalling vs. NAT is insufficient is not true with today's firewalls.

Improve this answer

You must log in to answer this question.