Do I need to setup NAT or ACL configurations for my DMZ setup?

Question

I'm trying to setup a network configuration in my company like the one in the picture below. A web server publicly accessible in the DMZ but insulated from the internal LAN.

For the firewall I'm using the Cisco RVS4000 4-Port Gigabit Security Router with VPN router.

Before setting the DMZ configuration on the router, I was able to ping and ssh back and forth from the LAN host to the server, which I understand as "the server is in the LAN".

After configuring the router to set the server into the DMZ, I'm still able to ping and ssh in both directions on both hosts and I expected to not being able to ping from the server to the host on LAN, which leads to my question:

1. Do I need to configure ACL or NAT rules to insulate the server to create connections to the LAN host? If yes, then what is the DMZ setting doing?

2. The DMZ was not supposed to setup the router to block access to the internal LAN?

Any help would be appreciated. Thanks in advance.

Answer 1

technically speaking , ASA allows traffic from higher security level toward the lower level security area unless if u define an explicit ACL to do so. Your local are security level should have higher level than DMZ and DMZ higher than outside area. IF you follow this rule u should not be able to initiate any traffic from DMZ toward yr local area nodes. Based on this rule, nobody from outside have access to yr DMZ area so u should define Static NAT or PAT to allow traffic to yr servers from outside area. I hope this will help you. Thank you.