On Mon, 2007-11-19 at 22:53 -0700, Clint Pachl wrote:
quoted text
> In my DMZ research, some sources state that all services need to be 
> replicated in each DMZ. Following that advice, I would have to setup 
> Kerberos, ntp, backup, and DNS in each DMZ and the LAN; that sounds like 
> a lot of work. What do you guys think?

That you are basically bypassing your own firewall. Just create a third
subnet for your management services and allow only the lan and dmzs to
access it through the firewall. Not perfect but IMHO better than
establishing a direct path between a dmz and a lan and adding complexity
to monitor traffic on that path.

ciao

Luca