Public and private intranet web site

[outonalimb]

We have been asked to host our newly designed Intranet on IIS. However, we have been asked to let staff members browse the intranet from their home PC's but not expose certain confidential pages outside of the company internal network.

Can anyone please give me a strategy for doing this? Ideally, we don't want to password protect the site to cut down on administration. Any external user should be denied access to certain pages when a certain link is clicked on.

Regards,

 

[jshurst]

If you don't have a password on the site then how will IIS know who is coming in? It doesn't have to be a password that you keep up with, it can simply be an AD password, but your going to need some kind of authentication.

Here are some things you can do.
1) You can have your web programmers protect certain pages using some kind of authentication (Forms, LDAP, etc).
2) You could set two different sites up and either use a) a different port, or b) different http-headers for Inter/Intra users.
3) You could use MS SharePoint and lock down specific pages (especially 3.0 sites)


4) Use VPN and have clients connect directly to your Intranet - this is probably the safest way because you don't expose anything to the outside world.

Hope it helps,

J

 

[WhoKilledKenny]

I like all of Jhurst's ideas...

The question I would ask is, what is the requirement to allow users from home to access the intranet? With that answered, we could give you a good reason for choosing one of Jhurst's suggestions or possibly another.

 

[FaiTHLeSS]

To allow users to access the site from home you would just need to setup a pointer to your external IP address and depending on your network setup forward port 80 to the internal server though you might want to create some sort of DMZ to put the server in.

Another way to retrict access would to put the pages you dont want people to access externally into a folder and put an IP restriction on that folder.

You could always look at SSL, for added security and make sure external users authicate against your intranet before getting access to it to.

 

[lhuegele]

The best thing to do is to require users to get to your internal network over a VPN connection. That way they can work and access your intranet as if they are right there in the office. VPN traffic is also usually encrypted, giving you more protection from snoopy folks.