04-21-2008 10:48 AM - edited 03-11-2019 05:34 AM
My ISP supplies a single x.x.x.x public IP address for my WAN interface and also routes a small public IP subnet to it so I can have a range of IPs to use.
On an ASA 5505 Can I have both a private LAN (10.x.x.x) and my public range set up on a DMZ? Or do the DMZ addresses have to be private also and NATted to the public WAN interface?
Solved! Go to Solution.
04-21-2008 11:43 AM
Thomas
It is your choice. As long as the ISP routes the public IP subnet to your outside interface of the ASA and as long as the address on the outside interface of the ASA is not out of the same subnet then yes you can use that public addressing for servers on your DMZ.
Personally, i would recommend against it and use private addressing for your DMZ servers and NAT them to public IP addresses. Reason beng if you ever change ISP or need more public IP addressing it is easier to make changes on the firewall rather than potentially having to readdress the physical servers.
But you may have good reasons for using the public addressing on the servers and although NAT works with most applications it doesn't work will all of them.
Jon
04-21-2008 11:43 AM
Thomas
It is your choice. As long as the ISP routes the public IP subnet to your outside interface of the ASA and as long as the address on the outside interface of the ASA is not out of the same subnet then yes you can use that public addressing for servers on your DMZ.
Personally, i would recommend against it and use private addressing for your DMZ servers and NAT them to public IP addresses. Reason beng if you ever change ISP or need more public IP addressing it is easier to make changes on the firewall rather than potentially having to readdress the physical servers.
But you may have good reasons for using the public addressing on the servers and although NAT works with most applications it doesn't work will all of them.
Jon
04-21-2008 12:17 PM
Thanks for your reply.
I asked the question mainly because I'm going to be replacing an old aging 26xx-series router with an ASA and wanted to make sure our existing public IP-ed DMZ would continue to work.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide