I've been trying to learn about DMZs. It's hard to find a technical explanation that does not dive head long into the complexities of Cisco hardware, which I'm finding confusing as I'm new to networking. Can someone explain why most internet posts I've read on making a DMZ advises to use a layer 2 switch to connect devices within it? Let say for example, I'm running a small business and in my DMZ I want to put a web server, a DNS server and a general data server that a mobile app I built is pushing and pulling data from, why is it bad to use a layer 3 switch? I've put a text based diagram below to give you an idea of the shape of DMZ

                                             ----- WEB SERVER
                                             ----- DATA SERVER 
  • Because typically the gateway will be the Firewall and most Firewalls can also route and you can specify exactly what hosts/ports/services are allowed for every individual hosts. The switch will just forward the frames, which simplifies the design. We're using this design also, though we are also using different VLANs on the switch to segment a bit more. – user36472 Mar 3 '19 at 11:51

A layer-3 switch is primarily a layer-2 switch, but with a routing module in it. A layer-3 switch that is not configured with multiple networks is simply a layer-2 switch. Routers, including the routing module in a layer-3 switch, route traffic between networks. Is there any reason that you need the DMZ to be anything more that a single network?

It is likely that your servers are all simply on the same network. If you have multiple networks in the DMZ, then you would need a router or layer-3 switch in the DMZ, but then you would need to tell the first router about the networks behind the router in the DMZ, and that could be a problem.

Routers learn about routes in three ways:

  1. Directly connected networks.
  2. Statically configured routes (doesn't scale).
  3. Dynamically through a routing protocol (can be broken by a firewall or NAT).
| improve this answer | |
  • Thanks Ron. you are correct, the DMZ itself is only one network. I read networks should be in segments for security. for example, an office VLAN, a server VLAN for internal servers, a DMZ vlan. I thought to do that I'd need each vlan to have a routing switch to manage the subnetwork IPs for the devices connected to them. Then a dhcp sever could give the layer 3 switches addresses. The DMZ would be a subset within these VLANS. Apologies if this sounds wrong. I'm new to this and still grappling with the theory. – Jay Black Mar 3 '19 at 0:21

A DMZ is a security construct. That's where one places machines that are inherently untrustworthy -- eg. an internet accessible web site that someone, at some point, is going to break into. As such, the DMZ network is created to give the absolute minimal access to everything -- each machine within it, the internet, and most importantly: the rest of your network. If you've used a layer-3 switch, then your DMZ is presumably not physically isolated. If the switch exposes a management interface to the DMZ, then attackers could access the switch and escape the DMZ.

It's a best practice to have the DMZ as isolated as possible. I see DMZ's as VLANs all the time, and those instances are one bug, and/or one typo away from their security being compromised.

(For the record, my DMZ is a VLAN on my "public" switch. If you do compromise anything -- which would be a masterful stroke with no machines in it, you'll still be outside the firewall.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.