Tip

Perimeter networks

A perimeter network is the network closest to a router that is not under your control. Usually a perimeter network is the final step a packet takes traversing one of your networks on its way to the internet; and conversely the first network encountered by incoming traffic from the Internet. Most administrators create perimeter networks in order to place their firewall in between them and the outside world so that they can filter packet traffic. Most perimeter networks are part of the DMZ (Demilitarized Zone) if they exist at all. However, perimeter networks have some additional utilities that you might want to consider when deciding where to place systems and services.

Any small LAN separated from your other LANs by an internal router and outside LANs by your border router is a perimeter network. A perimeter LAN is the best place to put any service that can improve the reliability and trustworthiness of incoming data. For example, if you wanted to trap for security violations (hacking), your perimeter network might include a honeypot server meant to sustain and report on network probing. Another use of a perimeter network is to separate one type of network traffic from another. You might want to provide a director capability to your networks, perhaps sending HTTP traffic to one server (or set of servers) with mail traffic going to another. Furthermore, any site getting heavy traffic could benefit from a perimeter network that has not only directional capability but

    Requires Free Membership to View

load balancing attributes as well. A device like F5 Networks BigIP provides application traffic management of this latter type.

So having a perimeter network lets you better control security, provide more granular access to resources, and can substantially reduce network traffic on your main LANs making all of your other network services work better. For the price of an extra router it is a good practice to establish this type of architectural element.

If you want to read more about perimeter networks, the book "Inside Network Perimeter Security: The Definitive Guide to Firewalls, Virtual Private Networks (VPNs), Routers, and Intrusion Detection Systems" by Norhcutt, et al. may be very useful. For several reader reviews and one place to find this book go to Amazon.com.


Barrie Sosinsky is president of consulting company Sosinsky and Associates (Medfield MA). He has written extensively on a variety of computer topics. His company specializes in custom software (database and Web related), training and technical documentation.


This was first published in May 2004

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.