Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

DMZ server configuration

I'm a little unsure about how our servers are configured on our DMZ and I want to know if our setup is the best practice or if I'm doing it completely wrong.

We have 3 servers on our DMZ - 2 IIS/webservers, and 1 front end Exchange server. Each server has two NIC cards on them.

One of the NIC cards has an IP address on the DMZ IP space with a default gateway pointing to the DMZ interface of our PIX so that traffic can get back out. The other NIC card has an IP address on our internal network IP space so that it can talk with our domain, and it's directly connected to a switch on the inside network completely bypassing the PIX. This NIC card has no default gateway specified because Windows 2003 server doesn't like it when you have two NIC cards with two different default gateways.

Is this a bad configuration or is this somewhat normal? Thanks for any advice.


Re: DMZ server configuration

The term is being multi-homed. It's not just Windows 2003, you can't have 2 default gateways period. I would consider it bad security practice. For example, if someone would somehow take control of your dmz machine, they would have direct access to your inside bypassing pix.

Hall of Fame Super Gold

Re: DMZ server configuration


That is not the way that DMZ is usually done. Part of the normal rationale for DMZ is that devices go into the DMZ which are open to the public. The DMZ allows connectivity from outside and limits connectivity to inside. Therefore if one of the servers in the DMZ is comromised it does not allow the attacker direct access to the inside network. What you are doing in your situation is to provide direct and unprotected access to the inside network.

From a security perspective I would say it was not a good config.



Community Member

Re: DMZ server configuration

Then how do I give the servers in the DMZ access to servers on the inside network? The developers keep telling me that their web apps need to be able to access the domain for the SQL server connections, etc..


Re: DMZ server configuration

You need an access-list written to allow traffic in interface dmz and also a nat rule.

access-list dmz_access_inside permit tcp host host eq 1433

access-list dmz_access_inside deny ip

access-list dmz_access_inside permit ip any any

access-group dmz_access_inside in interface dmz

static (inside,dmz) netmask


static (inside,dmz) netmask

CreatePlease to create content