How to manage DMZ switches

[bdjezzar4490]

Hi there,

We have two switches on DMZ segment and we want access remotly via telnet but we don't want to give them public ip address.

With private ip address i can't access the switch because my gateway is PIX and we can't configure a secondary ip on the pix.

Any advise. Thank you.

[jstoecker]

What about moving all the "public" / "DMZ" ports into their own vlan(s), and having a dedicated VLAN for just the management console.

If the PIX can do 802.1Q trunking, you could then trunk the VLANs into the PIX, and set different security rules for the management VLAN than what you have for the public / DMZ VLANs.

Alternately, you could configure one physical port of the switch into the management VLAN and connect that back into your network infrastructure where you could telnet using an "inside" address.

A third alternative is to obtain an access router like a 2509, connect the ethernet port to your LAN, and use an octal cable into the console ports. Then, using "reverse telnet", you telnet into the 2509 which forwards the connection to the console ports. See the following document:

http://www.cisco.com/en/US/tech/tk801/tk36/technologies_configuration_example09186a008014f8e7.shtml

John

[bdjezzar4490]

Hi Stoecker,

Thank you very much for your response.

I don't know if i have really understand, but i try to translate your solution to the following steps:

1- Create a management vlan on DMZ switch.

2- Configure one physical port into the management vlan.

3- Connect that port into my LAN switch.

4- If my inside IP on the PIX is 192.168.1.1, the management vlan IP would be like 192.168.1.100 and the default-gateway 192.168.1.1

Please let me know if i am in wrong.

Finally, i have two questions:

1- Does the PIX-525 software 7.0(4) do the trunking?

2- Did you mean the ACL with security rules?

Best regards,

[devang_etcom]

you can do it by NAT also you can have the NAT on your PIX ... and reverse telnet is also good idea to configure and using that you can telnet to the perticular line number in order to access it...

rate this post if it helps

regards

Devang

[bdjezzar4490]

Hi Gopalbhai,

Thank you for your help.

Yes, i have nat on my pix but i don't see how i could use it to telnet my DMZ switch? Could you please give me more details.

Best regards,

[amit-singh]

Hi,

If I were you, I would have used NAT or Self static along with ACLS to accomplish this.

Yes, PIX 7.0 code has Dot 1Q feature.

HTH, Please rate if it does.

-amit singh