11.4 Summary

A DMZ, or even a multiple DMZ network, can be a useful way to isolate traffic to public servers, while still offering a level of protection through the firewall. It is important to remember, especially when dealing with DMZs, that a firewall is no substitute for good server security. A DMZ is an excellent layer of security, but it should not be the only one.

There are many different types of DMZ design. It is important to plan the DMZ carefully ; otherwise , it is very easy to wind up with a gaping hole in the network design. Careful planning prior to DMZ deployment can increase the level of security that the DMZ provides. This planning may involve the use of a multiple DMZ design. Multiple DMZs increase the complexity of the network, and can make managing the firewall rule sets more complex, but they can also increase the level of network security on the network.