topic That's right.I forgot to in Network Security

DMZ to Inside traffic

sqambera — Tue, 12 Mar 2019 06:19:29 GMT

Hello,

I want my DMZ (low security level) subnet to talk to Inside (high security level) subnet such that traffic will originate from the DMZ. I have heard that if the traffic originates from outside goes to inside, a static NAT entry should already exist on the ASA. Do I need to configure likewise static NAT in my case where I want DMZ network to talk to Inside network. Not to mention that both networks have private addressing scheme and I don't feel need to nat traffic.

Thanks in advance for answering my query.

You just need to create an

Dinesh Moudgil — Fri, 24 Jul 2015 00:49:55 GMT

You just need to create an access-list to allow the users to communicate from DMZ(low) to Inside(high) interface and apply it on DMZ interface in inbound direction. It will only allow the returning traffic and will block the traffic initiated from Inside to DMZ.

As long as they use private IPs , there is no need for the natting.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Many thanks Dinesh. A new

sqambera — Fri, 24 Jul 2015 01:23:14 GMT

Many thanks Dinesh. A new thought however after looking at your reply. You said that ACL applied inbound on DMZ will allow only returning traffic from inside and will block traffic originating from inside to DMZ. I am thinking that it should not block the traffic that is originating from inside to DMZ because it would be applied inbound on the DMZ?

Am I missing something?

Thanks again

Qamber

That's right.I forgot to

Dinesh Moudgil — Fri, 24 Jul 2015 01:35:05 GMT

That's right.

I forgot to mention that since inside interface is at higher security level then DMZ, it will allow the traffic initiated from inside interface.

Thanks for mentioning 🙂

Regards

Dinesh Moudgil

P.S. Please rate helpful posts.