DMZ Zone

saroj pradhan — Tue, 12 Mar 2019 03:55:54 GMT

Hi,

please advice the command to configure a DMZ Zone in the cisco Asa 5510 Firewall.

i have already inside and outside interfaces. All the users need to access the servers in the DMZ Zone and from internet as well.

All the servsers in the DMZ are configured with public IP Address.

please advice.

Regards,

Saroj

Assuming you are running 8.3+

Karsten Iwen — Wed, 12 Mar 2014 07:24:17 GMT

Assuming you are running 8.3+, you need:

An ACL on the outside interface allowing the needed traffic (example for allowing Web-traffic to your DMZ-host with IP 1.2.3.4):

access-list OUTSIDE-IN permit tcp any host 1.2.3.4 eq 80

If your NAT for internal clients is setup correctly and there is no ACL on the inside interface you are good to go. If you have an ACL on the inside, then you also need an entry to allow the traffic. That could look like the following if you want to allow all traffic from inside to the DMZ:

access-list INSIDE-IN permit ip any 1.2.3.0 255.255.255.0