topic DMZ Design in Network Security https://community.cisco.com/t5/network-security/dmz-design/m-p/2884975#M152794 <P>I have a DMZ that has a Cisco Nexus switch with VRFs as well as a physical firewall. &nbsp;Is it common in a DMZ environment to put the gateways for the DMZ systems on a Nexus VRF? Or should they be on the physical firewall? &nbsp;If they are on the VRF, then it would be much easier for a misconfiguration to allow traffic between two subnets where traffic shouldn't flow. &nbsp;If they are on the physical firewall, then there is a greater performance hit to the firewall to process more traffic, but greater visibility and centralized enforcement traffic flow policies between subnets.</P> <P>Your experiences and recommendations welcome...</P> Tue, 12 Mar 2019 07:55:49 GMT NotOfEarth 2019-03-12T07:55:49Z DMZ Design https://community.cisco.com/t5/network-security/dmz-design/m-p/2884975#M152794 <P>I have a DMZ that has a Cisco Nexus switch with VRFs as well as a physical firewall. &nbsp;Is it common in a DMZ environment to put the gateways for the DMZ systems on a Nexus VRF? Or should they be on the physical firewall? &nbsp;If they are on the VRF, then it would be much easier for a misconfiguration to allow traffic between two subnets where traffic shouldn't flow. &nbsp;If they are on the physical firewall, then there is a greater performance hit to the firewall to process more traffic, but greater visibility and centralized enforcement traffic flow policies between subnets.</P> <P>Your experiences and recommendations welcome...</P> Tue, 12 Mar 2019 07:55:49 GMT https://community.cisco.com/t5/network-security/dmz-design/m-p/2884975#M152794 NotOfEarth 2019-03-12T07:55:49Z The routing needs to be https://community.cisco.com/t5/network-security/dmz-design/m-p/2884976#M152795 <P>The routing needs to be symmetric. &nbsp;It is is just a single subnet I would take the Nexus switch out of that network (at a layer 3 level) and just run everything through the firewall.</P> Wed, 22 Jun 2016 00:06:15 GMT https://community.cisco.com/t5/network-security/dmz-design/m-p/2884976#M152795 Philip D'Ath 2016-06-22T00:06:15Z