Adding a Firewall Appliance - Does it give me security?

I'm have an existing server (2003 Standard) hosting several sites, with all
the bells and whistles. I have a new application I want to add which
requires the addition of a firewall appliance ( I'm looking at cisco 506 but
that shouldn't matter) I need this both for the VPN Tunnels & for security
issues.
I have approx 24 IPs running on this machine, with about 20 of them used for
different sites. I don't think I can assign this many IPs to a DMZ ( Can
I?). So, I'm trying to come up with some other solution.
What I'm thinking of doing is just adding a new ethernet connection (
actually just using the spare I have ) connected to the firewall, giving the
firewall one of the un-used IP address. Thus, I will have two subnets, my
existing IP allotment ( minus the 1 ), and the 192.168.xxx.xxx that I get
from the Firewall. I plan to have SQL Server 2005 instances running on the
IP addresses in the 192.168.xxx.xxx block.
I know this way is essentially stupid, but my client won't spring for a new
server, so I'm trying to make something work. This will give me my VPN
tunnels, so that is half the problem. My question is, does this provide me
any additional security at all? Is there any way to have the server
partitioned so that some of it is highly secure while some of it remains
essentially a DMZ?The real question would be why would installing a new application require a
chang in the LAN Topology involving a firewall device? That make no
sense,...Applications are supposed to be ablivous to the underlying
Topology.
Yes, introducing a firewall changes the LAN Topology unless it is replacing
an already existing device.
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
"Phil" <prounds@.cassandragroup.com> wrote in message
news:u%23aLPichGHA.4388@.TK2MSFTNGP05.phx.gbl...
> I'm have an existing server (2003 Standard) hosting several sites, with
all
> the bells and whistles. I have a new application I want to add which
> requires the addition of a firewall appliance ( I'm looking at cisco 506
but
> that shouldn't matter) I need this both for the VPN Tunnels & for
security
> issues.
> I have approx 24 IPs running on this machine, with about 20 of them used
for
> different sites. I don't think I can assign this many IPs to a DMZ ( Can
> I?). So, I'm trying to come up with some other solution.
> What I'm thinking of doing is just adding a new ethernet connection (
> actually just using the spare I have ) connected to the firewall, giving
the
> firewall one of the un-used IP address. Thus, I will have two subnets,
my
> existing IP allotment ( minus the 1 ), and the 192.168.xxx.xxx that I get
> from the Firewall. I plan to have SQL Server 2005 instances running on
the
> IP addresses in the 192.168.xxx.xxx block.
> I know this way is essentially stupid, but my client won't spring for a
new
> server, so I'm trying to make something work. This will give me my VPN
> tunnels, so that is half the problem. My question is, does this provide
me
> any additional security at all? Is there any way to have the server
> partitioned so that some of it is highly secure while some of it remains
> essentially a DMZ?
>
>|||The real question would be why would installing a new application require a
chang in the LAN Topology involving a firewall device? That make no
sense,...Applications are supposed to be ablivous to the underlying
Topology.
Yes, introducing a firewall changes the LAN Topology unless it is replacing
an already existing device.
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
"Phil" <prounds@.cassandragroup.com> wrote in message
news:u%23aLPichGHA.4388@.TK2MSFTNGP05.phx.gbl...
> I'm have an existing server (2003 Standard) hosting several sites, with
all
> the bells and whistles. I have a new application I want to add which
> requires the addition of a firewall appliance ( I'm looking at cisco 506
but
> that shouldn't matter) I need this both for the VPN Tunnels & for
security
> issues.
> I have approx 24 IPs running on this machine, with about 20 of them used
for
> different sites. I don't think I can assign this many IPs to a DMZ ( Can
> I?). So, I'm trying to come up with some other solution.
> What I'm thinking of doing is just adding a new ethernet connection (
> actually just using the spare I have ) connected to the firewall, giving
the
> firewall one of the un-used IP address. Thus, I will have two subnets,
my
> existing IP allotment ( minus the 1 ), and the 192.168.xxx.xxx that I get
> from the Firewall. I plan to have SQL Server 2005 instances running on
the
> IP addresses in the 192.168.xxx.xxx block.
> I know this way is essentially stupid, but my client won't spring for a
new
> server, so I'm trying to make something work. This will give me my VPN
> tunnels, so that is half the problem. My question is, does this provide
me
> any additional security at all? Is there any way to have the server
> partitioned so that some of it is highly secure while some of it remains
> essentially a DMZ?
>
>sql

Add Skuupgrade=1 ?

Hi!
I downloaded Sql server 2005 Standard directly, when I got this message. I am not used to the commandprompt, and does not know how to add Skoopgrade=1 .

Coud you please help me, may be I could add it in another way?
Thank you so much in advance!!

The SKUUPGRADE flag is used when upgrading one edition of SQL 2005 to another. Here is the documentation:

http://msdn2.microsoft.com/en-us/library/ms144259.aspx

[SKUUPGRADE]

Use the SKUUPGRADE parameter when upgrading from one edition of SQL Server 2005 to another edition of SQL Server 2005.

Important:

If you use the SKUUPGRADE parameter, Setup will remove all hotfix and service pack updates from the SQL Server instance being upgraded. Once the edition upgrade is complete, you must reapply all hotfix and service pack updates.

To perform an edition upgrade of a default instance of SQL Server 2005 (SQL Engine only) via unattended Setup, run the following command using either /qb or /qn:

start /wait setup.exe ADDLOCAL=SQL_Engine INSTANCENAME=MSSQLSERVER UPGRADE=SQL_Engine SKUUPGRADE=1 /qb

Thanks,
Sam Lester (MSFT)

|||Thank you so much!
So I run the following (I didn't use e CD)
C:\SQLEVAL\Servers\setup.exe ADDLOCAL=SQL_Engine,RS_Server INSTANCENAME=MSSQLSERVER UPGRADE=SQL_Engine,RS_Server SKUUPGRADE=1 /qb

.... and it tells me my operating system does not meet service packs levels for this release.

I already downloaded .net Framework 2, ISS, SQL Server 2005 Service Pack 1...

I have windows 2000 32-bit, Windows XP Service Pack 2

I would be so grateful for some help...
|||

I'm a little confused on your OS. Can you do start -> Run and type in "winver". This will tell you your OS and SP level. Can you let me know what that shows? That way we'll be able to figure out what you need to install to get going.

Thanks,
Sam

|||

G:\servers> setup SKUUPGRADE=1

Worked fine.

Also note the important section of the quoted post.

Add Skoopgrade=1 ?

Hi!
I downloaded Sql server 2005 Standard directly, when I got this message. I am not used to the commandprompt, and does not know how to add Skoopgrade=1 .

Coud you please help me, may be I could add it in another way?
Thank you so much in advance!!

The SKUUPGRADE flag is used when upgrading one edition of SQL 2005 to another. Here is the documentation:

http://msdn2.microsoft.com/en-us/library/ms144259.aspx

[SKUUPGRADE]

Use the SKUUPGRADE parameter when upgrading from one edition of SQL Server 2005 to another edition of SQL Server 2005.

Important: If you use the SKUUPGRADE parameter, Setup will remove all hotfix and service pack updates from the SQL Server instance being upgraded. Once the edition upgrade is complete, you must reapply all hotfix and service pack updates.

To perform an edition upgrade of a default instance of SQL Server 2005 (SQL Engine only) via unattended Setup, run the following command using either /qb or /qn:

start /wait setup.exe ADDLOCAL=SQL_Engine INSTANCENAME=MSSQLSERVER UPGRADE=SQL_Engine SKUUPGRADE=1 /qb

Thanks,
Sam Lester (MSFT)

|||Thank you so much!
So I run the following (I didn't use e CD)
C:\SQLEVAL\Servers\setup.exe ADDLOCAL=SQL_Engine,RS_Server INSTANCENAME=MSSQLSERVER UPGRADE=SQL_Engine,RS_Server SKUUPGRADE=1 /qb

.... and it tells me my operating system does not meet service packs levels for this release.

I already downloaded .net Framework 2, ISS, SQL Server 2005 Service Pack 1...

I have windows 2000 32-bit, Windows XP Service Pack 2

I would be so grateful for some help...
|||

I'm a little confused on your OS. Can you do start -> Run and type in "winver". This will tell you your OS and SP level. Can you let me know what that shows? That way we'll be able to figure out what you need to install to get going.

Thanks,
Sam

|||

G:\servers> setup SKUUPGRADE=1

Worked fine.

Also note the important section of the quoted post.

Add Skoopgrade=1 ?

Hi!
I downloaded Sql server 2005 Standard directly, when I got this message. I am not used to the commandprompt, and does not know how to add Skoopgrade=1 .

Coud you please help me, may be I could add it in another way?
Thank you so much in advance!!

The SKUUPGRADE flag is used when upgrading one edition of SQL 2005 to another. Here is the documentation:

http://msdn2.microsoft.com/en-us/library/ms144259.aspx

[SKUUPGRADE]

Use the SKUUPGRADE parameter when upgrading from one edition of SQL Server 2005 to another edition of SQL Server 2005.

Important:

If you use the SKUUPGRADE parameter, Setup will remove all hotfix and service pack updates from the SQL Server instance being upgraded. Once the edition upgrade is complete, you must reapply all hotfix and service pack updates.

To perform an edition upgrade of a default instance of SQL Server 2005 (SQL Engine only) via unattended Setup, run the following command using either /qb or /qn:

start /wait setup.exe ADDLOCAL=SQL_Engine INSTANCENAME=MSSQLSERVER UPGRADE=SQL_Engine SKUUPGRADE=1 /qb

Thanks,
Sam Lester (MSFT)

|||Thank you so much!
So I run the following (I didn't use e CD)
C:\SQLEVAL\Servers\setup.exe ADDLOCAL=SQL_Engine,RS_Server INSTANCENAME=MSSQLSERVER UPGRADE=SQL_Engine,RS_Server SKUUPGRADE=1 /qb

.... and it tells me my operating system does not meet service packs levels for this release.

I already downloaded .net Framework 2, ISS, SQL Server 2005 Service Pack 1...

I have windows 2000 32-bit, Windows XP Service Pack 2

I would be so grateful for some help...
|||

I'm a little confused on your OS. Can you do start -> Run and type in "winver". This will tell you your OS and SP level. Can you let me know what that shows? That way we'll be able to figure out what you need to install to get going.

Thanks,
Sam

|||

G:\servers> setup SKUUPGRADE=1

Worked fine.

Also note the important section of the quoted post.

Add replication component

Hello,
I have a publication that is pushed from a SQL 2005 Standard box to
about 40 SQL express subscribers. One of the servers went down and was
rebuild and I reran the same install script as I ran on the other
servers ( I made the script). I pushed out the same subscription as
before to it, and it is running smoothly (transactional). I then
needed to set up a snapshot subscription to all servers, and this
server was the only one that would not allow me to. When I try and set
up a new subscription to it I get this message:
"Replication components are not installed on this server. Run SQL
Server SETUP again and select the option to install replication.
(Microsoft SQL Server, Error: 21028).
So I thought I would just redo the setup and only pick the replication
component, but you cant, it makes you pick the whole database engine
tree to get it, and then the install says that it is already installed
and won't let you continue. Same happens if I go through add/remove
programs and use the add component link.
Any thoughts or ideas on this error. Right now the only solution I
have is reinstall from scratch.
OK, that error message was totally wrong. Since adding it through the
UI was not working, I added another subscription through the UI and at
the end generated a script file instead of actually finishing it. I
then changed the script file to point at my stubborn server that
supposedly did not have replication components, and the script ran fine
and the subscription was created, and worked.
PT
|||Can you try to create a local publication on this server? I am not sure if
this message is erroneous or not.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"Paul T." <weluvpaul@.hotmail.com> wrote in message
news:1168454660.767978.320110@.p59g2000hsd.googlegr oups.com...
> Hello,
> I have a publication that is pushed from a SQL 2005 Standard box to
> about 40 SQL express subscribers. One of the servers went down and was
> rebuild and I reran the same install script as I ran on the other
> servers ( I made the script). I pushed out the same subscription as
> before to it, and it is running smoothly (transactional). I then
> needed to set up a snapshot subscription to all servers, and this
> server was the only one that would not allow me to. When I try and set
> up a new subscription to it I get this message:
> "Replication components are not installed on this server. Run SQL
> Server SETUP again and select the option to install replication.
> (Microsoft SQL Server, Error: 21028).
> So I thought I would just redo the setup and only pick the replication
> component, but you cant, it makes you pick the whole database engine
> tree to get it, and then the install says that it is already installed
> and won't let you continue. Same happens if I go through add/remove
> programs and use the add component link.
> Any thoughts or ideas on this error. Right now the only solution I
> have is reinstall from scratch.
>

Add a clustered index in a published table

Hi,
I am using SQL 2K standard and have created a transactional replication
between two sql servers using push subscritpion. It is working fine. Now I
want to add a clustered index in one of the published tables and I get an
error message saying that "Cannot alter the table because it is being
published for replication". Based on this message, I assume I will have to
disable all publishing and distribution, add the clustered index and then
redo the publishing and subscriptions for all the tables from scratch again.
Am I right? Is there another way to do this?
Any help on this will be very much appreciated.
Wingman
Interesting. 'Create Index' isn't really an 'Alter Table' so I'm wondering -
are you doing anything else in the same batch eg changing the PK?
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com
(recommended sql server 2000 replication book:
http://www.nwsu.com/0974973602p.html)
|||Paul,
Thanks for the quick response.
Here are the steps I did.
1. Open the existing publishing database in the SQL enterprise manager.
2. Select 'Design' of the table which is a published table in the
publication.
3. Select the primiary key
4. Check the box of the clustered index.
5. Close the design window and click 'save' to save the changes.
6. Then the error occurs.
There are no other batches involved and I was just doing the above. I hope
this clarifies any questions for you.
Wing
"Paul Ibison" wrote:

> Interesting. 'Create Index' isn't really an 'Alter Table' so I'm wondering -
> are you doing anything else in the same batch eg changing the PK?
> Cheers,
> Paul Ibison SQL Server MVP, www.replicationanswers.com
> (recommended sql server 2000 replication book:
> http://www.nwsu.com/0974973602p.html)
>
|||I can't test this right now, but I'd try to run this command:
CREATE CLUSTERED INDEX index_name ON table ( column_name )
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com
(recommended sql server 2000 replication book:
http://www.nwsu.com/0974973602p.html)
|||Yep, I did and it ran succussfully without any problem. The clustered index
is created. Thanks for this suggestion.
Can you explain why I can't do this in EM? Is it just the limitation of
using this type of interface?
Also, do I need to do the 'create clustered index...' in the subscription
server or the push replication will take care of it? In the future, if I
need to add non-clustered index, will this be the way to do it?
Wingman
"Paul Ibison" wrote:

> I can't test this right now, but I'd try to run this command:
> CREATE CLUSTERED INDEX index_name ON table ( column_name )
> Cheers,
> Paul Ibison SQL Server MVP, www.replicationanswers.com
> (recommended sql server 2000 replication book:
> http://www.nwsu.com/0974973602p.html)
>
|||If you run profiler when applying changes to a table using the Enterprise
Manager interface you can usually determine the cause of tis type of problem.
In this case the table was probably being dropped in the background. The same
issue applies in SQL Server 2005 where if you select to replicate DDL
changes, the Management Studio will fail whereas ALTER TABLE will succeed.
If you want this applied to the subscribers you have to apply initiate this
yourself. You could use sp_addscriptexec to use the replication setup or just
apply it manually.
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com
(recommended sql server 2000 replication book:
http://www.nwsu.com/0974973602p.html)
|||Sorry, don't mean to keep the discussion going that long but I have a few
follow-up questions regarding sp_addscriptexec.
1. Are there any benefits and differences using sp_addscriptexec compared
to manually executing the script in the subscriber computer?
2. If I use the sp_addscriptexec command to move the scritpt to the
subscriber(s), when or under what situation will the script be excecuted and
how often?
3. If I decide that I no longer need those scripts after using
sp_addscriptexec, how do I remove it from the subscriber computer?
Wingman
"Paul Ibison" wrote:

> If you run profiler when applying changes to a table using the Enterprise
> Manager interface you can usually determine the cause of tis type of problem.
> In this case the table was probably being dropped in the background. The same
> issue applies in SQL Server 2005 where if you select to replicate DDL
> changes, the Management Studio will fail whereas ALTER TABLE will succeed.
> If you want this applied to the subscribers you have to apply initiate this
> yourself. You could use sp_addscriptexec to use the replication setup or just
> apply it manually.
> Cheers,
> Paul Ibison SQL Server MVP, www.replicationanswers.com
> (recommended sql server 2000 replication book:
> http://www.nwsu.com/0974973602p.html)
>
|||There are no extra benefits of sp_addscriptexec in terms of running the
script. However, it may be the case that you have dozens of subscribers, or
perhaps some are offline. In this was it gives you convenience and assures
you of getting the script to the subscribers. They'll receive the script when
they synchronize, and the script won't be run more than once and won't be
retained on the subscriber's computer.
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com
(recommended sql server 2000 replication book:
http://www.nwsu.com/0974973602p.html)
|||Ok, thanks.
When I go to the subscription computer and check all replicated tables, I
notice that none of the primary key is defined but the index key for the
primary key is there. Why is it?
Also, when I checked the snapshot properties of the pubished article
defaults in EM, the non-clustered index check box is grayed out. Is there a
way I can activate it so I can uncheck it because I don't want the
non-clustered index to be replicated?
Wingman
"Paul Ibison" wrote:

> There are no extra benefits of sp_addscriptexec in terms of running the
> script. However, it may be the case that you have dozens of subscribers, or
> perhaps some are offline. In this was it gives you convenience and assures
> you of getting the script to the subscribers. They'll receive the script when
> they synchronize, and the script won't be run more than once and won't be
> retained on the subscriber's computer.
> Cheers,
> Paul Ibison SQL Server MVP, www.replicationanswers.com
> (recommended sql server 2000 replication book:
> http://www.nwsu.com/0974973602p.html)
>
|||PKs are replicated as unique indexes by default in transactional replication.
If you enable the DRI option checkbox on the snapshot tab of the article
properties, the PK will be recreated on teh subscriber. For the chackboxes on
this tab, some are related to others, so try checking/unchecking others to
see if you can enable the nonclustered option. However not all combinations
are supported using this method and in some cases you have to resort to
scripting the replication instead.
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com
(recommended sql server 2000 replication book:
http://www.nwsu.com/0974973602p.html)