Will This Work??

Hi everyone,
I have a small query on networking and wonder anyone could enlighten me on this and if this scenario is possible.
My box is Win2K Pro which has a net card connected to a broad band service to a secure wesite for downloading data from a government agency. After this data is downloaded it is then copied using a diskette or a cd and is uploaded to our internal central processor for further processing. The internal network is using a different ip add. and the Win2K box is using an ip add as provided by the government agency. In this scenario is it possible to install two net cards in the Win2K box with diff ip addresses??? lets say one user named "External" logs into the system and downloads the data. After that another user "Internal" logs in and then uploads the data into the central processor? The box must then be hooked up to the internal Lan Hub for this.
Could someone out there, throw me some light on this. Thanks a million in advance
Regs
Ffive

Hi ffive,

Yes, normally, Win2K Pro does support having 2 separate network cards with different IP addresses. You may need to edit your network configuration to ensure proper routing, but, in theory, you shouldn't even have to, your routers should do that. You would not have to switch users for this (and I don't even know if you could limit a user's access to one network card and not the other, maybe with a separate hardware profile).

However, before you go down this route, you may want to verify whether the government agency you are dealing with would allow this construction. If they have supplied you with a separate network address, not directly or fully connected to the rest of the big bad world out there, they may not like the idea of you creating this connection.

Cheers,

BrainStop

Hi
I suggest the following: Connect the "external" as usual to the "gov agency". After the download is done, just disconnect the network cable, connect to the internal Hub / switch and upload to your "internal processor". with this you will not violate (to my knowledge) and legal binding of your contract. (normally, transfer of data by electronic means will be permitted, provided security precautions are taken care of). For this particular folder, please change the permissions of access to "external" and "internal" users.

As per the internal connectivity is concerned, you may have to connect a simple proxy machine with two NICs, one having "external" IP address and the other "internal IP". If you think that this is not possible for economic, simple sol etc., you can change the IP address of the machine without rebooting.

Good luck
Nadiminti

1- I'll say that is your internal network is highly sensitive, you'll introduce a risk by using a XP workstation in the middle of internet/intranet.
Even if the PC does not have ip forwarding active, an attacker could gain admin access to the PC and use it to bounce into ur network ... (I would not do that...)

2- Be aware that windows can have just a single default gateway (0.0.0.0). There is no problem by using sveral NICs (I think its up to 4 for many mother boards) but the default gateway will have to be on the internet side. For the internal side you'll have to configure statically your internal routes (it could be aggregated in 1 or 2, I guess!).
TO configure statics routes on windows use the route add command from the dos prompt.

...

nadiminti that is a good thought, but you are probably still going to void any aggreements doing it that way. Because whenever you connect the box to the "internal" network it could still be compromised and infected. Then whenever it's hooked back up to the "goverment" connection it could then attack that system. You know what I mean, having trojans being spread and what not. Right now you are copying information to a media, than taking it from the current box to the processor. So therefore nothing from the outside is going into the box that's hooked up to the "goverment" connection.

Yeah I would suggest talking to the goverment agency as they would tell you whether or not they would like their box being connected to any other network. Maybe they would want you to setup a hardware firewall between the system connected to their network and your internal network. But yeah in general your idea will work. It's like setting up an ICS (Internet Connection Service) on a Win2k box to connection a broadband connection to an internal network (which is what it is generally used for).

Just an added thought...
~AciD

thanks guys, will first of all talk to the govn agencies and work it out with them first. and then will try to do this.
Thanks again
Ffive

let us know how it goes!