New DMZ in FWSM

[Faisal Shabbir]

Hi Freinds,

we have two FWSMs on 6509 boxes, inside secuirty level is 100, outside is zero one dmz has security level  zero i want to create another dmz ..

could someone explain me the steps to create dmz in FWSM i am not expert on FWSM also the new DMZ should be to communicate with existing dmz,

ospf is running on fwsm

Regards,

Malik

[Julio Carvajal]

Hello Faisal,

Check the configuration with the show run and follow the same configuration commands

Interface vlan X

name if DMZ_2

ip address x.x.x.x x.x.x.x

Security level #

Then create the right NAT for the traffic between the vlans and ACL as needed

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

Thanks Julio for your reply my concern was what security level should i assign to new DMZ so it could  communication to existing vlan and servers in new DMZ will also accessed through SSL VPN from outside

inside interface security level 100

outside interface security level 0

existing dmz security level 0

new dmz security level ???

finally why we need NAT ??

Regards,

[Julio Carvajal]

Hello Faisai,

For that you will need to consider the servers/devices you will set on that interface.

If there are critical boxes then set a higher security level (100) so you can control traffic on a more responsible way (denying traffic from lower to higher by default) so you can modify as your needs instead of using a lower security level and allowing traffic to it by default.

So at the end it will all depend on what you host behind it.

Now depending on the security level you will configure NAT and ACLs.

NAT is needed in order to be able to communicate with Public IP address with a private IP address, Remember that for you to go through the internet you MUST have a public IP address.

NAT is here to do two things:

Preserver the IPv4 Address space

Allow you to communicate over the internet with another host

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

Thank for brief reply i am not natting anything on FWSM there is default route on outside interface connected to another vendor device, we are doing natting on that box not on FWSM,

NOW my question is if i set security level 50 for new DMZ do i need ACL to allow traffic to talk to existing DMZ which has security level zero as well as for outside interface??

[Julio Carvajal]

Then No Nat is needed here.

With a security level of 50 traffic from new DMZ to old DMZ will be allowed as well as going to Outside.

Now for traffic generated on the other side you WILL need an ACL.

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

sorry Julio which other side ???

[Julio Carvajal · Accepted solution]

Let's say you want to connect to a server on the New DMZ from the old DMZ or the Outside interface.

You will be going from lower to higher so an ACL will be needed on the lower security interface in the IN direction.

Remember to rate all of the helpful posts  such as the ones I have provided Faisal

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

Thanks Julio for your help

[Julio Carvajal · Accepted solution]

Hello,

No problem Faisal.

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

sorry to bother you again julio i fiound this line on running config could you tell me why its there

static (dmz-abc,outside) 10.9.2.0 10.9.2.0 netmask 255.255.255.0

[Julio Carvajal · Accepted solution]

Hello,

That's basically an Identity NAT.

That lets the FWSM know that the 10.9.2.0 will look like 10.9.2.0 on the outside interface ( A No Nat rule)

so as you said you do not have any NAT no worry is basically doing nothing hehe

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

Thanks

[Julio Carvajal]

Sure,

And remember to rate the answers (let me know if you do not know how)

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Faisal Shabbir]

normaly you can an ineter sh run int vlan xyz to chekck the any ACL and rest of the config under any vlan how can you check in fwsm that is there any acl is under vlan

sh run int vlan xyz ??