DMZ setup using Cisco 2811 Router

Answered Question
Aug 12th, 2011
User Badges:


I am pretty new to the configuration of a DMZ and I have the task of setting one up.

I have a Cisco 2811 Router running Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 12.4(24)T1, RELEASE SOFTWARE (fc3), 2 FE interfaces.

One FE is connected to the WAN, with a loopback interface configured with the public IP for Internet access in the office.

The other FE has 2 sub interfaces configured, one for data and the other for voice traffic.

Users within the office are configured to use the data VLAN to access the internet through the WAN.

Now we are setting up some new services and we require to have DMZs setup.

I want to setup 3 zones now that the different servers would reside in. How can i achieve this using the existing infrastructure I have?

I have an idea to create more subinterfaces and assign them to the zones, but I am still not sure how this would play out. I have been on this for the whole day and unable to make significant progress. Would appreciate any help and guide what so ever.



Correct Answer by ajay chauhan about 5 years 11 months ago

Ok then you can go for another sub interface for new vlan  make it part of DMZ ,Assign new IP range  and use the ip inspect feature of firewalling.

This might help.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
ajay chauhan Fri, 08/12/2011 - 10:58
User Badges:
  • Silver, 250 points or more

are you going to use any firewall ?


femi.agboade Fri, 08/12/2011 - 11:01
User Badges:

Hi Ajay,

I intend to use the firewall module/add-on on the 2811 IOS for this purpose.

An ASA will be deployed much later towards the end of the year or Q1 2012.



femi.agboade Fri, 08/12/2011 - 11:42
User Badges:

Hi Ajay,

Thanks for the suggestion and the link. Though I was looking for a more definitive step-by-step guide that could help me arrive at the goal faster. I'm not familiar with firewall rule setup, but will see what I can do tonight based on URL you sent.

Thanks again.


femi.agboade Wed, 08/17/2011 - 08:10
User Badges:

Hi Ajay,

So what I did was to create multiple VLANs and corresponding Security Zones on the router. Each VLAN was assigned to a Security Zone. Using firewall rules, I resprticted traffic between the VLANs to meet the specific need of what i needed to achieve.

Thanks for the heads up again.




This Discussion

Related Content