3

I have a Cisco Nexus switch that I'm using as my core router. It has a connection to a firewall that handles internet-bound traffic. The switch acts as the default gateway with a default route to the firewall.

I am building out a DMZ vlan and I would like to force all DMZ-to-internal traffic through the firewall, rather than using the local routes on the core switch. I understand I can do this with PBR, setting the next-hop for traffic from this vlan to the firewall.

However, I would like to specifically allow SMB traffic from my DMZ vlan to my NAS (located in one of my internal vlans) to bypass the firewall, since my firewall link is 1Gb and the rest of my network is 10Gb. I understand that I need to use a combination of ACLs and PBR on my DMZ vlan to accomplish this, but I cannot figure out the right combo. My thought is an ACL allowing SMB traffic from the DMZ vlan to the NAS, then PBR for the rest of the DMZ vlan traffic. When I try to do this though, all non SMB traffic is just dropped by the ACL rather than being PBR'd.

Is what I want possible? What should the ACLs and PBR policy look like? Thanks for any advice in advance.

Edit to add: I know this would be made easier if I just made the firewall the gateway and made all routing decisions there, but then I would lose out on 10Gb throughput between internal devices, as my firewall only has 1Gb interfaces.

Improve this question
3
  • Any traffic in or out of a DMZ should pass through a firewall, else it is not really a DMZ. Devices in a DMZ are only semi-trusted. Allowing any direct access to your corporate network means they are just part of the corporate network, not in a DMZ. If something in the DMZ gets compromised, you need a firewall from it to your corporate network to buy time to either shut it down or remediate it.
    – Ron Maupin ♦
    Commented Oct 17 at 15:34
  • Sure, fair enough. This is in a homelab deployment where my plex server is in the DMZ and my NAS is in a trusted vlan and I want to have 10Gbps file transfer to plex while keeping the rest of the traffic isolated. I would not do something like this in a corporate setting.
    – NotGene
    Commented Oct 17 at 15:46
  • I'm more just wondering if this is possible in my deployment, which I admit is unusual because: I want a DMZ for the sake of learning how to set one up, but I also want 10Gbps SMB traffic between the DMZ and my NAS. In a corporate setting I would get a firewall with higher throughput. Just want to know if what I'm trying to do is possible, setting aside whether it's truly secure.
    – NotGene
    Commented Oct 17 at 15:49

1 Answer 1

Reset to default
2

I understand I can do this with PBR, setting the next-hop for traffic from this vlan to the firewall.

What you seem to ask about isn't actually policy-based routing, which is routing based on anything else but the destination address. PBR would allow you to route a request from the DMZ for an internal server out of the WAN interface - which you don't want I guess.

Rather, you seem to aim for inter-zone routing restrictions that deny/drop those requests. You could implement these using ACLs on the core switch.

A better (=simpler, more resilient) solution is to skip any SVI address on the L3 switch, connect the firewall directly to the DMZ VLAN and use that as the default gateway directly.

If you want faster private access to the DMZ than the firewall allows, you need to use the core switch as default and very carefully craft your ACLs. Remember that ACLs are stateless, so it's a bit more effort than the usual firewall policies. E.g. don't just allow traffic from TCP 80 from a DMZ web server to LAN, but from TCP 80 to a TCP >=1024 on LAN (or >=32768/49152, depending on your LAN hosts).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.