Figure 15.
Example configuration of a DMZ
Internet
Internet
iLO provides the capability to create a separate, secondary network (iLO Net in Figure 14) that is
parallel to the primary or production network. This dual network architecture has the benefit of
completely segregating management traffic from production network traffic. It facilitates system-wide
server management activities, including servers inside the DMZ, while maintaining maximum security
by limiting access to the production network.
Figure 15 shows a packet-filtering router that acts as an initial line of defense. Behind this router is a
firewall system. There is no direct connection from the Internet or the external router to the internal
network. All traffic to or from the internal network must pass through the firewall system. An additional
router, which filters packets destined for the public services in the DMZ, protects the internal network
from public access.
The firewall is a multi-homed host, and it can be configured to evaluate traffic according to different
rules based on the traffic source and destination:
•
from the Internet to the DMZ
•
from the DMZ to the Internet
•
from the Internet to the internal network
•
from the internal network to the Internet
•
from the DMZ to the internal network
•
from the internal network to the DMZ
32
