SAN attaching 2 WINTEL server residing in the DMZ security/ issues / p

[StorMan]

Hi All

I have a request to attach 2 servers (CLUSTERED MSCS) running W2K Adv (SP3) w/QLA2340-e-sp hba to our production SAN.
These 2 servers will be in the DMZ. I am pushing back not to allow any servers in the DMZ to be SAN attached. I would appricate any comments

 

[Persevalli]

I believe that you can accept those servers in the SAN , if you configure them to not be "managers hosts".

Do you imagine some king of host-based attack?

Thanks.

 

[McAndKA]

Just ensure that the disk controllers on the SAN use the controller based LUN masking the prevent those servers in the DMZ from being capable of seeing any other LUNs. You might also consider switch zoning for additional security.