Question about setting up DMZ interface with Sub-interfaces for ASA
We currently have PIX 525 firewalls with one DMZ 4-port card installed. There are 4 different public web servers connected to the ports. We are in the process of upgrading to the ASA models and had some questions about design layout. The number of public web servers will grow from 4 to 10 or 15. What is the best way to keep these servers isolated from each other using the ASA appliance? I was thinking using one of the physical ports and create sub-interfaces off of it. Then attached a Cisco 3750 series switch to that port and create private vlans. Is this layout a recommended approach or is there a better way of laying this out? Just wanted to know if my thinking was on track.
Re: Question about setting up DMZ interface with Sub-interfaces
Using subinterfaces and trunking interface with 3750 is a good approach, but you have to keep in mind the following
1) If I recall correct, max 20 VLANs supported with sub-interfaces
2) If you are not using NAT and you directly assign public IPs, you need different global IP subnets for each subinterface. If you have for example 18.104.22.168/29 and 8 available hosts in that subnet, you cant assign 22.214.171.124 to one subinterface and 126.96.36.199 to another one. It should be like 188.8.131.52/29 to subint1 184.108.40.206/29 to subint2 220.127.116.11/29 subint3 and so on. But as long as you use private IPs in webservers and use NAT in firewall, there is no problem.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...