topic Is it standard proceedure to allow internal users to access DMZ servers? in Network Security https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701230#M1009617 <P>I have never allowed my internal users to access web based front end servers in my DMZ but it seems a lot of companies are doing this now. So the question is:</P><P>Is it standard proceedure to allow internal users to access DMZ servers?</P> Mon, 11 Mar 2019 09:50:10 GMT cclinton383 2019-03-11T09:50:10Z Is it standard proceedure to allow internal users to access DMZ servers? https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701230#M1009617 <P>I have never allowed my internal users to access web based front end servers in my DMZ but it seems a lot of companies are doing this now. So the question is:</P><P>Is it standard proceedure to allow internal users to access DMZ servers?</P> Mon, 11 Mar 2019 09:50:10 GMT https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701230#M1009617 cclinton383 2019-03-11T09:50:10Z Re: Is it standard proceedure to allow internal users to access https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701231#M1009619 <HTML><HEAD></HEAD><BODY><P>well I guess you are the best person to decide that...moreoever if you really need it thana you can open port 80 by applying access-list on inside interface allowing only port 80 to dmz apart making sure the access-list doesnt block anything else...</P></BODY></HTML> Wed, 21 Mar 2007 17:37:36 GMT https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701231#M1009619 abinjola 2007-03-21T17:37:36Z Re: Is it standard proceedure to allow internal users to access https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701232#M1009620 <HTML><HEAD></HEAD><BODY><P>Actually I was hoping to get the Cisco veiw on if this is a good standard practice and are there any security reasons not to allow internal users direct access to the DMZ servers.</P><P></P><P></P></BODY></HTML> Wed, 21 Mar 2007 17:48:52 GMT https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701232#M1009620 cclinton383 2007-03-21T17:48:52Z Re: Is it standard proceedure to allow internal users to access https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701233#M1009621 <HTML><HEAD></HEAD><BODY><P>well Cisco Tac recommends as much narrowed down access-rules/permissions as possible, not a complete hole in the system....so try to narrow it down to specific hosts and specific services and ports using the access-lists</P><P></P><P>access-l abc permit tcp any <DMZ network=""> eq 80</DMZ></P><P></P><P>access-l abc deny ip any <DMZ network=""></DMZ></P><P></P><P>access-l abc permit ip any any</P><P></P><P>access-g abc in interface inside</P><P></P><P>the above should be good </P></BODY></HTML> Wed, 21 Mar 2007 17:54:44 GMT https://community.cisco.com/t5/network-security/is-it-standard-proceedure-to-allow-internal-users-to-access-dmz/m-p/701233#M1009621 abinjola 2007-03-21T17:54:44Z