04-21-2008 10:48 AM - edited 03-11-2019 05:34 AM
My ISP supplies a single x.x.x.x public IP address for my WAN interface and also routes a small public IP subnet to it so I can have a range of IPs to use.
On an ASA 5505 Can I have both a private LAN (10.x.x.x) and my public range set up on a DMZ? Or do the DMZ addresses have to be private also and NATted to the public WAN interface?
Solved! Go to Solution.
04-21-2008 11:43 AM
Thomas
It is your choice. As long as the ISP routes the public IP subnet to your outside interface of the ASA and as long as the address on the outside interface of the ASA is not out of the same subnet then yes you can use that public addressing for servers on your DMZ.
Personally, i would recommend against it and use private addressing for your DMZ servers and NAT them to public IP addresses. Reason beng if you ever change ISP or need more public IP addressing it is easier to make changes on the firewall rather than potentially having to readdress the physical servers.
But you may have good reasons for using the public addressing on the servers and although NAT works with most applications it doesn't work will all of them.
Jon
04-21-2008 11:43 AM
Thomas
It is your choice. As long as the ISP routes the public IP subnet to your outside interface of the ASA and as long as the address on the outside interface of the ASA is not out of the same subnet then yes you can use that public addressing for servers on your DMZ.
Personally, i would recommend against it and use private addressing for your DMZ servers and NAT them to public IP addresses. Reason beng if you ever change ISP or need more public IP addressing it is easier to make changes on the firewall rather than potentially having to readdress the physical servers.
But you may have good reasons for using the public addressing on the servers and although NAT works with most applications it doesn't work will all of them.
Jon
04-21-2008 12:17 PM
Thanks for your reply.
I asked the question mainly because I'm going to be replacing an old aging 26xx-series router with an ASA and wanted to make sure our existing public IP-ed DMZ would continue to work.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: