[FW1] DMZ using Public IP range without Subnetting.

["Lawson, Shawn M." <smlawson@FW1-NOSPAMeoriginal.com>]

We have 30 public addresses, one for the router, one for the firewall and
the others are natted through to the internal LAN. We want to create a DMZ.
Someone has suggested just moving the public address to another port off the
firewall to create the DMZ.  The firewall would have two public IP address
one on the port to the router and the other to the switch of the DMZ.  We
would create workstation entities for each device in the DMZ and use them to
build rules to allow or block traffic to those devices.  My gut tells me
that we need to subnet the public address so that the firewall can route
between the two subnets.  I don't understand why it wouldn't work but then
again I don't know if it will.  Attached is a diagram of the proposed
solution showing the DMZ on the same subnet as the external firewall port
and router.  Anybody know if this will work?  If not, why?  What is everyone
else doing?  Are you using a private IP range and natting the public
addresses or are you using a larger public IP pool and subnetting it to
create different networks for the DMZ?




 <<DMZProposal.gif>>

Attachment: DMZProposal.gif
Description: GIF image