topic Access list for DMZ in Network Security

Access list for DMZ

anil.sanap — Tue, 12 Mar 2019 02:06:54 GMT

hi,

have an below subinterface,

interface GigabitEthernet0/2.50

description *** Connected to DMZ ****

vlan 50

nameif DMZ

security-level 50

ip address x.x.x.x/27

need to allow this subinterface accessible through out network

Access list for DMZ

pankaj29in — Thu, 04 Jul 2013 05:00:50 GMT

Hi Anil.

apply an acl saying "any" can access your DMZ ip address on outisde interface.

Regards

Pankaj

Access list for DMZ

anil.sanap — Thu, 04 Jul 2013 05:14:28 GMT

access-list DMZ_access_in extended permit ip X.X.X.X 255.255.255.224 any

access-list DMZ_access_in extended permit icmp X.X.X.X 255.255.255.224 any

access-group DMZ_access_in in interface OUTSIDE-ZONE

does this correct one or still need to add anything waiting

Access list for DMZ

Jouni Forss — Thu, 04 Jul 2013 05:32:37 GMT

Hi,

You have to be a bit more specific in your question.

We would also need to know the software level possibly.

If you want to allow traffic to the DMZ from other local interfaces then you use those interfaces ACL to allow that traffic.

If you are talking about allowing traffic to DMZ from other remote network (Internet) then you will have to use the "outside" interfaces ACL to allow this traffic. In addition to this you naturally have to have a NAT configuration for the DMZ servers/hosts so that that they have a public IP address on which they can be accessed.

If you simply want to allow traffic from DMZ to anywhere else then you would use

access-list DMZ_access_in extended permit ip X.X.X.X 255.255.255.224 any

access-list DMZ_access_in extended permit icmp X.X.X.X 255.255.255.224 any

access-group DMZ_access_in in interface DMZ

- Jouni

Access list for DMZ

pankaj29in — Thu, 04 Jul 2013 05:38:22 GMT

Hi Anil,

yours will also do or you can also apply Jouni ACLs (both will work)

Regards

Pankaj

Access list for DMZ

anil.sanap — Thu, 04 Jul 2013 05:39:34 GMT

Hi,

thanks, thing is do have MPLS connectivity with other branch location

for those need to allow DMZ access

Access list for DMZ

Jouni Forss — Thu, 04 Jul 2013 06:19:15 GMT

Hi,

Then we would need to know about your NAT and Routing configurations.

It might be that ACL configurations alone wont enable DMZ connectivity.

The best situation is usually to give the source/destination networks and the current configuration with masked public IP addresses and sensitive information. Otherwise the discussion might be needlesly complicated.

- Jouni