Best position for Caching Server (Proxy)

[DrGreen26]

I have a question and would like som input from you folks.

Where is the best place to put a Caching server? Hang it off the DMZ? Put it between the physical private network and the firewall? Put it on the other side of the firewall (on the publick network)?

If anyone can shed some light on this, i would appreciate it.

Thanks Mark C. Greenwood, CNE
m_jgreenwood@yahoo.com

With more than 10 years experience to share.

 

[Visitor]

Is there a "best" place? I always thought it was a personal preference thing... We currently have out Stratacache box on the other side of the firewall (public side). But we're planning on moving it into the DMZ. I'd be interested in hearing some other views on this as well...

 

[Provogeek]

All of my installs of BM have it on the inside of the firewall (in most cases, it IS the firewall).

How you install it depends on your configuration prefrences.

In side firewall pros:
The server gets intergrated into your tree. This allows you to use proxy authentication to prevent unauthorized web usage. Allows you to create a log of who went were by NDS user ID.

In side firewall cons:
It's part of your tree, and will need a replica for proxy authentication.


Outside firewall pros:
You would have to place the server in it's own tree, so your typical configuration can be install and forget.

Outside firwall cons:
It would be, well, stupid to span your tree through the firewall, so the BM server would be in it's own tree. If you want to use proxy authentication, you have to enter user ID's for people authorized to use the net. Logging will be IP address based only, and if you use NAT, the log can be deamed useless. You would be better off getting a Volera cache server for this (it's a novell product).



In both cases, you want to use two NICs if you have a heavy web traffic. A single nic will get saturated.

Brent Schmidt CNE,Network +
Senior Network Engineer
Keep IT Simple

http://www.kiscc.com