Network Firewalls: Defending Data with the DMZ

By Edward Tetz from Cisco Networking All-in-One For Dummies

For computer networks, the demilitarized zone (DMZ) is an area where you have placed servers that the public at large — or at least people outside your network — need access to. In the non-computer world, a DMZ is an area two opposing military forces have declared as a buffer zone between each other. Both sides agree that they will stay out of that area.

The DMZ servers are placed outside your network and may have the ability to talk to your internal server. Although the servers are placed outside your network, they are not totally unprotected; they are still behind a firewall in a configuration similar to one of the options shown in the illustration.

The DMZ segment may be installed next to your current firewall or may be an actual zone between your network and the public network. Either is a valid DMZ option, each offering a benefit tradeoff between ease of configuration and security.

In the same manner as creating a DMZ, some companies have isolated their servers on a separate network segment, with a firewall defending that segment.

In this scenario, they have a DMZ protecting their public facing servers, their users behind the DMZ with protection from another firewall, and then their servers protected from their users behind yet another firewall.

This scenario means that if an attack or a virus gains access to the user network, it will not get immediate access to the servers as well. Although this setup may seem a bit paranoid, it is very secure.