Multiple DMZs

BRO,

can you explain better your question?

Thanks

It seems like most people configure 1 DMZ for their network but I can configured 5 DMZs and thought I better verify whether that was a good or bad idea.

I already have 1 dmz already configured, then I have two layer 3 Routers that need to go into a dmz zone and configured 2 more dmz interfaces for the HA failover Active\Passive Failover.

Port 3 DMZ -Dr's Office   172.x.x.1\24

Port 5 DMZ MEDVPN Router 10.10.10.1\24 (connect router directly into port)

Port 6 DMZ R2 - Router to Datacenter 10.10.20.1\24 (connect router directly into port)

Port 7 DMZ Peer HA link 172.1.1.1\24

Port 8 DMZ HA - Dedicated HA Link Port 10.10.2.41\24

My spare switch is a HP 1810-24G.  The firewall rules will be completely different for the 2 routers and it might be easier to separate them.  What do you think?

It seems like most people configure 1 DMZ for their network but I can configured 5 DMZs and thought I better verify whether that was a good or bad idea.

I already have 1 dmz already configured, then I have two layer 3 Routers that need to go into a dmz zone and configured 2 more dmz interfaces for the HA failover Active\Passive Failover.

Port 3 DMZ -Dr's Office   172.x.x.1\24

Port 5 DMZ MEDVPN Router 10.10.10.1\24 (connect router directly into port)

Port 6 DMZ R2 - Router to Datacenter 10.10.20.1\24 (connect router directly into port)

Port 7 DMZ Peer HA link 172.1.1.1\24

Port 8 DMZ HA - Dedicated HA Link Port 10.10.2.41\24

My spare switch is a HP 1810-24G.  The firewall rules will be completely different for the 2 routers and it might be easier to separate them.  What do you think?

I do not understand the difference between port 7 and 8.

IF you want to create different zone, create additional LAN zone (or DMZ) and add the physical port as your needs. On those zones, do not enable services that you do not need (under Administration > Device Access).

Pay attention when you create firewall rules. Use the proper zone and source/destination networks.

Regards

I was using port 7 and 8 to be identical to this article for configuring the High Availability in the Firewall.

https://community.sophos.com/kb/en-us/123174

Ok.

I plan to put the XG (gateway mode) in production this Saturday 4-8-17 from 12am to 1 am.  What is the best way in your opinion to double check all your settings at the last minute. 

BRO,

if your layer 2 and 3 is all well planned and the proper firewall rules are created, you will manage possible errors (ips, web, waf, application) directly inline.

Good luck!

Thanks!