Intermediate networks (Good practice or false sense of security)?

I'm not really sure what you call them, but is it good practice to create an intermediate network between your private network and public side. For instance private 192.168.1.0/24 <---> intermediate 10.1.1.0/24 <---> Public. What benefits are there for doing this? What are some negatives? Please enlighten me.
Thanks

I'm sure there will be different opinions on this - here is mine.
I don't see any benefit to the intermediate network. As you mentioned, it's quite common to use a "three legged" firewall with an inside, outside and DMZ interface.
On the ASA for example, the interfaces are usually numbered with inside 100, DMZ 50, and outside 0. Traffic is always permitted from high to low but never low to high unless a) it's a response to a request from a higher number interface or b) it's explicitly permitted in on an ACL.
One big benefit to doing this "three leg" approach is that you can put an ACL on the outside interface to only let traffic in to the DMZ subnet but not to the inside subnet - making the inside better protected from the outside world.
In the event that the DMZ does become compromised, it can not initiate sessions into the inside network because it has a security level higher than the DMZ.
Having the intermediate network could be, in a way, an alternative approach to the "three leg" solution though not as elegant or effective. The intermediate network could be a DMZ with public servers which is further firewalled from the inside network.

Similar Messages

  • JTable: RFC on good practice (SQL queries from cell editor)

    I usually add/remove/edit JTable data from an external panel. But in this scenario, my client would like to be able to click on the first column of an empty row and enter a product number. Within the cell editor, I must make an SQL query to the database in order to determine if the product number is valid and if so, use part of the SQL data to populate other cells of the current row (like product description).
    My problem is that this just doesn't seem right! Isn't the cell editor executed on the only Swing thread? Also, if the product number is not valid, I correctly implement the stopCellEditing() method but for some reason, you can still navigate the table (click on any other cell or press the TAB key, etc)... weird!!
    Does anyone have a good practice on how to perform the SQL query in a better place and force a cell to be selected until you enter a valid number or press the CANCEL key?
    I was looking at implementing the TableModelListener's tableChanged(...) method but I'm not sure if that would be a better place either.
    I personally would edit outside of the table, but good practice seems hard when the requirement is to edit from a cell editor!!
    Any suggestion would be greatly appreciated!
    Thanks!

    maybe you could write an input verifier for the column that does the query and rejects invalid entries.
    maybe you could send the query off in a worker thread.
    as far as making the table so you can't select any cells, hmm. not sure.
    you could disable
    .setEnabled(false);the table until the query comes back, something like that.

  • Is that a good practice to use syncronize methods for application scope cls

    Is that a good practice to use synchronize method in a application scope class, so I have a doubt, there a is class A, it has application scope and it contains a synchronized method add, so because of some network traffic or any unexpected exception client1 got stuck in the method, will that add method available for any other client...?
    Edited by: navaneeth.j on Dec 17, 2009 4:02 AM
    Edited by: navaneeth.j on Dec 17, 2009 4:04 AM

    If it needs synchronization, then it probably doesn't belong in the application scope. Either keep it as is, or reconsider the scope, or make it static.

  • 10Gb Networking best practices

    I'm looking for good guidance on Hyper-V 2012 R2 network configuration best practices for a converged server. Meaning, dual 10Gb NICs and using SMB 3.0 file shares for storage. The servers also have two 1Gb NICs. I'm very familiar with VMware, but ramping
    up on HV networking best practices.
    Blog: www.derekseaman.com, VMware vExpert 2012/2013

    Derek,
    I tried to draw my prefered setup for this network configuration.
    I would create a Team with the two 1 GBit NICs and use it for Domain, DNS, Backup and any SystemCenter Agents.
    I would also Team the two 10 GBit NICs and than assign it to a Hyper-V Switch for the VMs. In Windows Server 2012 it is posible to create vNICs for the Management OS that use this Hyper-V Switch (Converged Network Design). I would create two vNICs SMB1
    and SMB2 to use them for Cluster and Livemigration traffic with SMB Multichannel. If your storage system supports SMB Multichannel you can also use both as storage NICs (but this depends wich vendor you have).
    Hope this helps.
    Grüße/Regards Carsten Rachfahl | MVP Virtual Machine | MCT | MCITP | MCSA | CCA | Husband and Papa |
    www.hyper-v-server.de | First German Gold Virtualisation Kompetenz Partner ---- If my answer is helpful please mark it as answer or press the green arrow.

  • Good practice question

    there is a procedure p(i in number, o out number) that checks some data and finishes this way if some criteria are met:
    procedure p(i in number, o out number) is
    select count(*) into v_counter
    from ... ;
    if v_counter > 0 then
      o := 123;
      return;
    end if;
    exception
      when others then
      o := 99999;
    end;is this a good practice to finish this way (ie. return) or some other ways would be better in terms of "good practice" (like raising custom exception and handling it in exception block where out variable could be set up)?
    I would appreciate your suggestions about good practices in scenario above.
    thank you

    943276 wrote:
    there is a procedure p(i in number, o out number) that checks some data and finishes this way if some criteria are met:
    ..snipped..
    is this a good practice to finish this way (ie. return) or some other ways would be better in terms of "good practice" (like raising custom exception and handling it in exception block where out variable could be set up)?I would call using out params as exception/error codes wrong. Never mind good or acceptable practise. It is just plain wrong. As wrong in PL/SQL as it would be wrong in Java, C#, Pascal or another language that implements exceptions.
    Why? Because in such a language an exception is raised to indicate an error condition - an exception to the norm has occurred. If code suppresses the exception, that code is now saying that there is no error condition. It explicitly tells the caller that processing was successful and no exceptions to the norm have occurred.
    Returning the error code as an out parameter is not acceptable - as the "contract" in such a language, between the caller and that code, states that errors are handled as exceptions. That is how the language is designed to be used. That is how the run-time of the language works.
    Violating this fundamental concept in such a language makes absolutely no sense.

  • Is VHDX for data drive considered good practice on a client PC?

    Hi!
    I don't like putting user's data files (documents, etc.) inside the user's Documents directory on C:. Instead I prefer having them on a D: disk, separate from the OS. On the other hand I don't want to create a fixed size partition as I consider it a waste
    of space, especially when everything is on a rather small SSD.
    Therefore, I consider creating a virtual hard disk (VHDX) on my C: drive and making it dynamically expanding. This would allow me to store data on that "separate" disk which is actually an expanding VHDX file on C:. One problem is that for some
    unknown reason Windows 8.1 is not able to auto-attach such disks on startup, but I have seen some workarounds to auto-mount them through tasks.
    My question is the following: Is it considered good practice to put all data files on such a dynamic VHDX instead on a separate partition? Reading the VHDX explanations it looks like this file format is very stable (even in case of power loss) and is widely
    used in virtual servers. Performance should be also very good. Therefore I don't see any reason to not use it for my data drive. Or are there any drawbacks?
    Thanks in advance for any help.
    Best regards,
    Anguel

    Hi,
    Since the VHDX is created on C which should be the system partition, I don’t think it is more safety than separate partition.
    Please consider that once the system corrupted and we have to format the C to reinstall the System, it may be difficult for us to recovery the date. But the separated partition will be easily stayed without changes.
    You can try to shrink the C volume in Disk management to create a new partition.
    Just my thought.  
    Kate Li
    TechNet Community Support

  • What is a good practice to handle LOV in jdev apps?

    Hi, experts,
    In jdev 11.1.2.3,
    In our projects, there are many LOVs which the value are stored in a common dictionary table, for example in table refcode:
    refcode(id, low_value,high_value,meaning,domain_no),
    Different LOVs will retrieve value pairs(low_value,meaning) , or (high_value,meaning) from refcode table by using domain_no as the filtering criteria.
    In the end user's UI, the code/number field values should be displayed by a meaning word from refcode,
    To accomplish this goal, I will create numberous associations between different tables with refcode,
    and create VOs to have refcode entity view as a secondary entity view.
    I feel some odd in doing so(because so many associations with the same refcode table),
    Is that a good practice to handle LOV this way ?
    Thanks.

    On Fusion Developer's Guide for Oracle Application Development Framework
    10.3 Defining a Base View Object for Use with Lookup Tables
    (http://docs.oracle.com/cd/E37975_01/web.111240/e16182/bclookups.htm#BABIBHIJ)
    10.3.3 How to Define the WHERE Clause of the Lookup View Object Using View Criteria
    There are valuable information and suggestions on implement lookup features, especially by using view criteria
    (the View Criteria and View accessor is one of important and great idea in ADF)
    I think, by using of view criteria, the derivative attribute to display fk information can be implemented in a convinent way without FK associations definition.

  • Overloaded methods-yes or no & is this a good practice

    say i have two methods with the same name that take in the same parameters and have the same return type. the difference between the two is that one is static while the other is not. Also the methods contain different codes.
    are the methods going to function normally when i use em? also if they do function normally, is this essentially a good practice?
    if code is needed to answer this, please do mention it and i will think of a mini scenario where this can be applied and write a small piece of code for that.
    thanx. help will be appreciated.

    avi.cool wrote:
    duffymo wrote:
    each account has its own password that the user sets when the account is created-this password is declared as a state variable in the class file. One password per account? A bad model, IMO. My on-line banking software associates credentials with me, not my accounts. I see several accounts when I log in, and I don't have to log in individually for each one.
    besides that, theres also a bank password-this is declared and initialized as a static state variable in the class file. some of the operations require the bank password for access while others require account password.Static bank password? I'm very glad this is a throw-away student exercise, because you have no idea what you're doing.hahaaa, tru tru, its for a skool assignment for my first ever programming course. though not a throw away, i putting a lot of work into this :-) i m not actually trying to resolve any security issues here or strengthen account security. basically, I am only trying to exhibit a tiny bit of creativity while showing understanding of course contents. so nothing to stress on :-D i know not very creative but its all i got at this stage.
    i was trying to exhibit the use of overloaded methods in my program by having method to check the password that the user enters to access operations.
    now the ones that require account password, i was thinking of having the password check method as a non-static method since its associated with the object.
    while the ones that need bank password, i wanted to have as static method.
    i wanted both methods to have the same name.You've no idea what you're doing.
    how i solved it,
    i decided on having both methods as static methods. the one that checks account password, takes in two parameters, the account name(object name) and the string to be checkd. the one that checks bank password, takes in only one parameter- the string to be checked.Wrong.i would be really thankful if you could help me rectify my mistake and advice on how i should be doing this. is there a conceptual error? i am a bit confused now.
    Its exactly what I told you.. but now, you just have to come on here and post this :p
    and isn't this sort of like cheating? :P I mean this IS our exam you know... You're basically asking other for the arithmetic and logic lol.

  • What is good practice for playing multiple video's in a single swf?

    Hello,
    I have build in the past a video wall with video's inside. After building this i came across some problems.
    If you have too many video players loading at once it takes a lot of processing and the tweens in the
    page while loading the video's where not moving fluidly, but more in a stuttering way.
    After lot's of test i found a good working solution.  I imported the flv video's into flash en exported them on the timeline
    as a embedded swf.  Then i externally loaded these swf files and that performed much better.
    Is it even good practice to load multiple video instances at once? I used this time the LoaderMax of greensock but the video's
    only play after it's completely loaded. I would like to find a way to progressive play all video's at.
    Does someone has experience with this?
    Regards,
    Chris.

    How about an XML file which supplies the title for each movie and the location or source of the video to be played?  Simple version below.
    <?xml version="1.0" ?>
    - <playlist>
    <video src="Gfx/video/Alex1.f4v" title="John Deere 330" />
    <video src="Gfx/video/Benni1.f4v" title="Hitachi Z240F" />
    <video src="Gfx/video/Scotti1.f4v" title="Hitachi Z350F" />
    <video src="Gfx/video/Scotti2.f4v" title="Hitachi Z350F" />
    </playlist>
    JR

  • Is it good practice to auto submit forms?

    My users use forms that involve lots of textual matter and sometimes when after working for hours typing into the forms they might move out to some other links there by not submitting the form.
    Is it a good practice to auto save the contents of the form if there has been no inactivity for 5 minutes?
    What are the pros and cons of this approach?
    One problem the above approach could throw is if the user actually types in some data and forgets to close the browser window, the forms keeps on getting submitting unintentionally. This is ok with the user.
    Other alternatives like prompting the user for saving at frequent intervals have been thought of.

    as long as you can determine there's been no activity (simple enough with onblur/onfocus and other events in the fields) and can save the contents in a way that is not a submission, then it's not a bad idea. I wouldn't save after X minutes while the user is doing some entry, cuz it may interrupt what they are doing. Or you could use hidden frames and JS to save things without affecting the user.

  • Good Practice for managing player high scores & other stats

    During PC based game development, what is a good practice for saving high scores, game history etc for multiple users in terms of the following attributes :
    file types, data types to be used in the file, file protection from manual editing etc.
    pls throw some advice on the popular industry practice in use.
    regards, bittu ch

    During PC based game development, what is a good practice for saving high scores, game history etc for multiple users in terms of the following attributes :
    file types, data types to be used in the file, file protection from manual editing etc.
    pls throw some advice on the popular industry practice in use.
    regards, bittu ch

  • Is it necessary to use this. on objects or is it just good practice?

    Is it necessary to use this. on objects or is it just good practice?

    warnerja wrote:
    yawmark wrote:
    Is it necessary to use this. on objects or is it just good practice?It's good practice to use it when it's necessary.
    ~No, it's only necessary to use it when it's necessary.
    It's good practice to use it when it's good practice.<****/>
    <****/>
    <****/>
    (the sound of one hand, clapping)

  • Good Practices and Code Conventions

    Hi All,
    What are the good practices in java? Are there coding convention to be followed?
    I would like to improve my coding standards and write better code. Please help me.
    Thanks
    Diana

    Diana12 wrote:
    Then how to make it excellent?Are you serious? Do you expect us to give you a 2-line summary of how to make "excellent" code?
    It takes some time to learn to write excellent code and it can't easily be summarized into 1-2 sentences. If it could, then it would be much easier to learn (that would be nice!).
    Experience, making mistakes, realizing they were mistakes, not making the same mistakes later on. Having your code criticized by someone who writes better code than you. That's how you learn to write excellent code.
    Write simple code, keep it clean, make each method do one thing, write code that doesn't need documentation, document where you must, adhere to the open-close principle, adhere to the KISS principle, adhere to the YAGNI principle, ...
    Grab [The Pragmatic Programmer|http://www.pragprog.com/the-pragmatic-programmer] and read it. Then read it again. Do some more exercises and read it a third time.

  • Is it the good practice?

    Hi,
    With OIM 11g, I try to implement different UI requests for user creation.
    A request for external users and a request for internal users.
    For both of them, UI displays only :
    -Last name
    -First name
    -Birth Date
    For external user request, email is generated by firstname an lastname and prefixed by external.
    For internal user request, email is generated by firstname an lastname and not prefixed.
    To do that, I would like to use the request API "Platform.getService(RequestService.class)" in an event handler to get the request template name and generate the mail according to the template name.
    Can I get the request id in the event handler?
    Is it the good practice?
    Regards,
    Pierre.

    user1214565 wrote:
    thank you very much bbagaria,
    Can I use different datasets for user creation, one for external user, one for internal (I thought I could only modify and use the default dataset: /metadata/iam-features-requestactions/model-data/CreateUserDataSet.xml for all creation request)?
    If yes, how? (I tried to import MyCreateInternalUserDataSet.xml but it didn't work)
    With the default dataset, I expected to create two request templates, one for internal and one for external and get the template name in the a preprocess event handler.
    Regards,
    PierrePierre,
    I would suggest that you just modify the CreateUserDataSet.xml (not rename but import it back at same location in MDS [over-write]) to add additional field for type of user (hidden if you want) and use prepopulate with the type of user internal or external based on the template selection. The prepopulate adapter takes in RequestData object and that has getRequestTemplateName() method. Or just populate the email based on the template selection.
    I haven't tried this but theoretically it seems that you can user this.
    http://download.oracle.com/docs/cd/E17904_01/apirefs.1111/e17334/oracle/iam/request/vo/RequestData.html#getRequestTemplateName__
    HTH,
    BB

  • Good practices for ECC 6.0 wr.t. internal tables..

    hi,
    i am told that when defining internal tables in ecc 6.0, we shud avoid using OCCURS and WITH HEADER LINE.  and always use work areas..
    is this right ? is this a good practice or a must ?
    i followed this and created an internal table without a header line .then i  am using a collect statement in my programn which fails and says that IT is not with header line !!
    COLLECT ITT.
    what to do ?
    thks

    Yes, that is correct.  SAP is pushing the use of ABAP Objects and you can not use OCCURS or HEADER LINEs in the ABAP OO context.  You should always defined explicitly and a work area.
    Data: itab type table of mara.
    Data: wa like line of itab.
    So then you must keep this in mind when doing any operations on internal tables, like in the case of the COLLECT statement, the syntax would be.
    wa-field1 = '1'.
    wa-field2 = '2'.
    Collect wa into itab.
    Regards,
    Rich Heilman

Maybe you are looking for