Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

DMZ Access restriction

Untitled.jpg

My issue lies in DMZ security. What i have is an ASA5505 acting as my firewall and NAT device. I am NATing ports 21, 80, 9987 and 6667 to servers on my DMZ. The DMZ has its own dedicated interface on my 2621XM router and has an IP address of 10.20.0.254. I want to permit the LAN and Private Wifi VLANs to access the DMZ, but i dont want the DMZ to access anything on my LAN except UDP over port 53 for DNS to my internal DNS servers. I was using the following ACL to acomplish this:

ip access-list extended DMZPolicy

permit udp any host 10.10.0.251 eq domain

permit udp any host 10.10.0.250 eq domain

deny   ip any 10.10.0.0 0.0.0.255

deny   ip any 10.30.0.0 0.0.0.255

deny   ip any 10.40.0.0 0.0.0.255

permit ip any any

The issue with this is that no other network can access the DMZ. How can i permit LAN traffic to access the DMZ without allowing vice versa?

  • LAN Switching and Routing
Everyone's tags (3)
1 REPLY

DMZ Access restriction

If you're doing this on a router, your better bet would be either CBAC or zone based firewalls. I would recommend ZBF since it's a little more robust than CBAC:

ZBF:

http://www.cisco.com/en/US/products/ps6441/products_feature_guide09186a008060f6dd.html

CBAC:

http://www.cisco.com/en/US/products/sw/iosswrel/ps183/products_configuration_guide_chapter09186a00800ca7c5.html

HTH,

John

HTH, John *** Please rate all useful posts ***
323
Views
0
Helpful
1
Replies