topic Create a DMZ Vlan in Network Security

Create a DMZ Vlan

jbogdan — Tue, 12 Mar 2019 00:17:45 GMT

I need to create a DMZ Vlan. Core switch is a 6509. FW is an ASA5520. Need to create a VLAN for DMZ purposes for outside facing servers. NAT is used on ASA. All help is appreciated.

Create a DMZ Vlan

Julio Carvajal — Thu, 01 Nov 2012 20:41:08 GMT

Hello,

Okay so you will create the vlan on the Core switch, then connected to one of the ASA interface,

All you need to do on the ASA is to create a NAT rule for that new vlan ( subnet), setup a route on the ASA pointing to that core switch in order to reach the new vlan.

Regards,

Julio

Create a DMZ Vlan

jbogdan — Thu, 01 Nov 2012 21:17:17 GMT

Addressing is the next question. Internally on the core I set a VLAN called DMZ-LAN of 10.90.x.x 255.255.0.0. Should I have used an address of one of my class C's instead? example: 192.160.223.x 255.255.255.0

Create a DMZ Vlan

Julio Carvajal — Thu, 01 Nov 2012 21:29:07 GMT

Hello,

No, that is not a requirement, you can use a different range,

Just add the following on the ASA

Route internal 10.90.x.x 255.255.0.0 core_switch_ip

Then

nat (internal ) 1 10.90.x.x 255.255.0.0

global (outside) 1 interface

Regards,

Create a DMZ Vlan

jbogdan — Thu, 01 Nov 2012 21:31:14 GMT

Thank you! Learning something new every day.

Create a DMZ Vlan

Julio Carvajal — Thu, 01 Nov 2012 21:50:57 GMT

Hello,

My pleasure to help,

If you do not have any questions, please mark it as answered,

Regards,

Create a DMZ Vlan

jbogdan — Thu, 01 Nov 2012 22:50:50 GMT

I'm confused by this statement:

global (outside) 1 interface

What interface?

Create a DMZ Vlan

Julio Carvajal — Thu, 01 Nov 2012 22:58:03 GMT

Hello,

That is used for the internal users to be be able to traverse the internet.

You need a public and routable IP to traverse the internet,

In this case the outside interface it's the public

Regards,

Julio

Remember to rate all of the helpful posts, if you do not know how to do that just let me know, I will teach you ;D