Cisco Expressway build/design

[mkuhn]

Keeping in mind proper best practice for setup/design of Cisco Expressway Cluster creation, we are currently in the process of building entirely new Expressways (E and C).  Our current setup is such that the external facing Expressway E is going through our DMZ.  We are working with a contractor who instead recommends setting this up with a direct connection to the outside internet switch.  Has anyone used a similar design, and if so, is this proper from a security standpoint?  Any feedback would be greatly appreciated.  Thanks.  

[Jonathan Unger]

Here are my thoughts on the preferred order of placement options for the Expressway appliances, assuming you are using VMWare here and not the "physical" appliance versions:

1. "Dual DMZ" deployment
1. Server Placement:
1. Expressway E LAN#1 in "DMZ A"
2. Expressway E LAN#2 in "DMZ B" with a static 1 to 1 NAT
3. Expressway C on the "inside" network
2. Advantages:
1. More secure since external traffic will traverse 2x DMZs
2. You do not have to trunk the VMWare environment directly to the internet as you would with option #2
3. Disadvantages:
1. Requires more firewall config with the second DMZ (increased complexity)
4. Other Notes:
1. This is my go to design for Expressway, in my opinion it is the best. If for some reason the EXP-E is compromised, the attacker still has a DMZ between themselves and the inside of the network.
   
   
2. "Single DMZ" deployment
   
1. Server Placement:
1. Expressway E LAN#1 in "DMZ A"
2. Expressway E LAN#2 directly connected to the internet
3. Expressway C on the "inside" network
2. Advantages:
1. Easier than option #1 since there is only a single DMZ to configure
3. Disadvantages:
1. Requires you to trunk the "internet" network to your VMWare environment.
2. Less secure than option #1. The EXP-E is not behind any firewall on LAN#2.
4. Other Notes:
1. This deployment method works just fine. If you only have one DMZ to work with, I would use this option.

I have also seen deployments that put the EXP-E LAN#2 behind an internet DMZ with one to one NAT and put LAN#1 on the voice network where the EXP-C lives. I do not recommend this approach as if the EXP-E were compromised, an attacker would gain access to the inside of your network. At minimum, keep a firewall between the EXP-C and the EXP-E.

I hope this helps.