Configure DMZ on routers Cisco Forum FAQ

Configure DMZ on routers Cisco Forum FAQ
Links: home · search · speed test · login · more ·

	Search for: in all FAQs
All FAQs » Cisco Forum FAQ » 40.2 Security Sample Configurations » 15913


Configure DMZ on routers (#15913)
Suggested prerequisite reading: »Cisco Forum FAQ »Basic Internet Firewall ACL for Routers without IOS image Firewall feature On these sample configurations, it is assumed the following occur * There are at least three network segments; outside (i.e. WAN or The Internet), inside (LAN), DMZ * These segments are within their own subnet (Layer-3 separation) * Inside subnet is 10.0.0.0/24 and DMZ subnet is 10.0.1.0/24 Sample #1: Total Separation between Inside and DMZ This sample assumes the following * Internet-only access for DMZ * DMZ cannot access inside * Inside cannot access DMZ interface Ethernet0 description LAN interface ip address 10.0.0.1 255.255.255.0 ip access-group 100 in ip nat inside ! interface Ethernet1 description WAN interface ip address 1.1.1.2 255.255.255.252 ip nat outside ! interface Ethernet2 description DMZ interface ip address 10.0.1.1 255.255.255.0 ip access-group 101 in ip nat inside ! ip route 0.0.0.0 0.0.0.0 1.1.1.1 ! ip nat inside source list 10 interface Ethernet1 overload ! access-list 10 remark Permitable Subnets to go out to the Internet access-list 10 permit 10.0.0.0 0.0.1.255 access-list 100 remark Restricted Inside network Access access-list 100 deny ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 access-list 100 permit ip 10.0.0.0 0.0.0.255 any access-list 101 remark Restricted DMZ network Access access-list 101 deny ip 10.0.1.0 0.0.0.255 10.0.0.0 0.0.0.255 access-list 101 permit ip 10.0.1.0 0.0.0.255 any Sample #2: Restricted Access on DMZ specific services from Inside This sample assumes the following * Internet-only access for DMZ * DMZ cannot access inside * Inside can access DMZ only for web (TCP port 80) and email (TCP port 25) interface Ethernet0 description LAN interface ip address 10.0.0.1 255.255.255.0 ip access-group 100 in ip nat inside ! interface Ethernet1 description WAN interface ip address 1.1.1.2 255.255.255.252 ip nat outside ! interface Ethernet2 description DMZ interface ip address 10.0.1.1 255.255.255.0 ip access-group 101 in ip nat inside ! ip route 0.0.0.0 0.0.0.0 1.1.1.1 ! ip nat inside source list 10 interface Ethernet1 overload ! access-list 10 remark Permitable Subnets to go out to the Internet access-list 10 permit 10.0.0.0 0.0.1.255 access-list 100 remark Restricted Inside network Access access-list 100 permit tcp 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 eq 25 access-list 100 permit tcp 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 eq 80 access-list 100 deny ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 access-list 100 permit ip 10.0.0.0 0.0.0.255 any access-list 101 remark Restricted DMZ network Access access-list 101 permit tcp 10.0.1.0 0.0.0.255 eq 25 10.0.0.0 0.0.0.255 access-list 101 permit tcp 10.0.1.0 0.0.0.255 eq 80 10.0.0.0 0.0.0.255 access-list 101 deny ip 10.0.1.0 0.0.0.255 10.0.0.0 0.0.0.255 access-list 101 permit ip 10.0.1.0 0.0.0.255 any Sample #3: Restricted Access on DMZ most applications from Inside This sample assumes the following * Internet-only access for DMZ * DMZ cannot access inside * Inside can access DMZ on any TCP-based application and DNS (TCP and UDP port 53) * Note that most applications are TCP-based. Therefore this sample applies to most network interface Ethernet0 description LAN interface ip address 10.0.0.1 255.255.255.0 ip access-group 100 in ip nat inside ! interface Ethernet1 description WAN interface ip address 1.1.1.2 255.255.255.252 ip nat outside ! interface Ethernet2 description DMZ interface ip address 10.0.1.1 255.255.255.0 ip access-group 101 in ip nat inside ! ip route 0.0.0.0 0.0.0.0 1.1.1.1 ! ip nat inside source list 10 interface Ethernet1 overload ! access-list 10 remark Permitable Subnets to go out to the Internet access-list 10 permit 10.0.0.0 0.0.1.255 access-list 100 remark Restricted Inside network Access access-list 100 permit tcp 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 access-list 100 permit udp 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 eq 53 access-list 100 deny ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 access-list 100 permit ip 10.0.0.0 0.0.0.255 any access-list 101 remark Restricted DMZ network Access access-list 101 permit tcp 10.0.1.0 0.0.0.255 10.0.0.0 0.0.0.255 established access-list 101 permit udp 10.0.1.0 0.0.0.255 eq 53 10.0.0.0 0.0.0.255 access-list 101 deny ip 10.0.1.0 0.0.0.255 10.0.0.0 0.0.0.255 access-list 101 permit ip 10.0.1.0 0.0.0.255 any feedback form by aryoba last modified: 2008-05-29 10:43:54

Thank you for using lo-fi dslreports.com - report bugs
© 99-2008 silver matrix LLC