topic DMZ question in Network Security

DMZ question

m.saunders — Mon, 11 Mar 2019 23:44:02 GMT

Am I able to apply an ACL within the same DMZ to prevent one host from talking to another............in that same DMZ.

DMZ X:

172.17.1.1 is allowed to talk to the internet and to internal hosts BUT,

Denied from talking to 172.17.3.3 which is on the same DMZ

Can I just do a:

permit ip host 172.17.1.1 any port whatever

deny ip host 172.17.1.1 host 172.17.3.3

Thanks

DMZ question

Derron Carstensen — Mon, 20 Aug 2012 19:20:21 GMT

In theory no...

The reason being if the destination resides in the same layer three boundary (same subnet) then the source will do an ARP request and find the destinations MAC. From there the source node will send the data directly to the destination's MAC.

There is no man in the middle (firewall) to filter this traffic. If you were routing between networks and the firewall was in the middle it would work.

DMZ question

m.saunders — Mon, 20 Aug 2012 19:27:22 GMT

So if we put both devices in 2 different DMZ's we can then apply ACL's around them and protect them from one another? Do they have to be in different subnets as well?

DMZ question

Derron Carstensen — Mon, 20 Aug 2012 19:33:15 GMT

Yes if you place them in two different DMZs (which would also be different subnets) then you can use ACLs on the firewall to allow/block specific traffic.

DMZ question

m.saunders — Mon, 20 Aug 2012 19:38:53 GMT

Thanks

DMZ question

Ramraj Sivagnanam Sivajanam — Tue, 21 Aug 2012 03:01:12 GMT

Hi Bro

You can't deny network traffic when the source and destination are in the same network address. However, if you still want to block access between these 2 devices (assuming both these devices are physically connected to the same Cisco L2 switches), you'll need to configure Private VLAN, on those switchports. This will work like a charm.

http://www.cisco.com/en/US/tech/tk389/tk814/tk840/tsd_technology_support_sub-protocol_home.html

P/S: If you think this comment is useful, please do rate them nicely 🙂

DMZ question

m.saunders — Tue, 21 Aug 2012 12:18:13 GMT

I'm not a bro but thank you for the response!! LOL This helps in my configuration.

Michelle