2

This is an attempt to clarify my original post which was too long.

My task is to add a DMZ to our network.

Currently, the internal network is connected to one ASA interface.

I have been able to set up a single device DMZ where one test laptop is directly connected to a spare ASA interface.

I am trying to expand the experiment to include our existing switch so I can prove that two devices can reside inside the DMZ.

My question is:

Should I be using two interfaces on the ASA and running two cables to the switch?

Or, should I somehow be using only one ASA interface and one cable to the switch?

Or, should I be using two interfaces and two separate switches (one in the DMZ and one in the internal network)?

EXTRA DETAIL ABOUT THE SETUP

The environment is:

  • ASA 5505:
    • 0/0:
      • outside
      • public facing IP
      • vlan2
      • security 0
      • connected to the serviced office building main network
    • 0/1:
      • inside
      • 192.168.47.1
      • vlan1
      • security 100
      • connected to 0/0 on a ProCurve 2510G-48
  • ProCurve 2510G-48:
    • DEFAULT_VLAN (came out of the box)
      • 192.168.47.50
      • 0/0:
        • uplink to the ASA 5505 0/1
      • The rest:
        • various servers
        • another switch to which our desktops are connected

My initial experiment:

  • ASA 5505:

    • 0/0:
      • outside
      • public facing IP
      • vlan2
      • security 0
      • connected to the serviced office buildings main network
    • 0/1:
      • inside
      • 192.168.47.1
      • vlan1
      • security 100
      • connected to 0/0 on the ProCurve 2510G-48
    • 0/2:
      • dmz
      • 192.168.48.1
      • vlan3
      • security 50
      • connected to TestLaptop1 with IP address 192.168.48.2
  • ProCurve 2510G-48:

    • As above

With NAT and access rules I got to the point where I can:

  • access the internet from TestLaptop1
  • access the TestLaptop1 from the internet
  • access one single device in the internal network from TestLaptop1 (to simulate limited internal access)
  • access TestLaptop1 from one single device in the internal network (to simulate management access)

I am now trying to add our existing switch into the mix.

2 Answers 2

1

I wouldn't change the DMZ VLAN ID from 3 (5505) to 10 (2510) - depending on which protocols are active (GVRP, MVRP), this may cause problems.

If you tag VLAN3 on 5505 port 0/1 and 2510 port "0/0" (the first port should be "1") you can trunk both VLANs 1 and 3 on the same cable. Then, on the 2510, just config all required DMZ ports with VLAN3 untagged and they should be within the DMZ.

6
  • Thank you Zac for your reply. It was a very long post and I wasn't sure anyone could be bothered to read it. I'm going to update it because I can now formalise the question; how do you set up a DMZ with one ASA 5505 and one switch. Googling this question provided a better hot rate and I found this article: supportforums.cisco.com/discussion/11941251/….
    – J.M.
    May 25, 2017 at 6:51
  • Just to clarify your answer, are you saying I have cabled it up right? I.e. I do need two connections from the ASA to he switch? And my mistake is that the DMZ ports in the switch need to be in the same vlan3 as the DMZ port on the ASA?
    – J.M.
    May 25, 2017 at 6:53
  • I eventually got this working. I changed the vlan on the switch to 3. I haven't tried the trunking yet. I've now got the ASA port 0/2 and 4 of switch ports in vlan 3. I've been able to connect to the test laptop from outside and to a selected test device on the internal network. In your opinion, should I try now to trunk so I can ditch the extra cable between the ASA and the switch? Or is two cables OK? I'm a dev by trade and I want to try and make sure I produce something that at least follows decent practice (which is why I thought maybe I should not be sharing a switch.
    – J.M.
    May 25, 2017 at 12:14
  • I'm going to mark your answer as the answer but hope you may come back to me about my last comment.
    – J.M.
    May 25, 2017 at 12:14
  • If you don't need the bandwidth you can use just one physical link between ASA and switch - depending on how much it bothers you, you can leave the 2nd cable, of course. Another consideration may be security which may look better with two cables - if you rule out VLAN hopping, VLANs are just as secure as physical links though.
    – Zac67
    May 25, 2017 at 12:58
0

It's totally depends upon how you design your network . Its better to have DMZ network in separate interfàce in cisca ASA firewall. Instead of having in single interfàce .

We will have more feasibility in configuring security policies in ASA firewall among internet , LAN , DMZ networks .

So concluding as per my opinion it's better to have saperate interfàce for DMZ networks. .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.