topic Re: How to create 2 DMZs in Network Security

How to create 2 DMZs

haroldgonzales — Mon, 11 Mar 2019 22:23:25 GMT

Hi,

I wanted to know how to create two DMZ with different network. 10.0.1.0 and 10.0.2.0.

Also, I want to know how the inside interface can have access on them

Thanks

Harold

How to create 2 DMZs

andyjames — Fri, 03 Feb 2012 09:22:14 GMT

Harold,

What hardware are you using for this?

Andy.

How to create 2 DMZs

jyothydas — Fri, 03 Feb 2012 10:36:04 GMT

subinterface and do.

Re: How to create 2 DMZs

haroldgonzales — Fri, 03 Feb 2012 16:01:59 GMT

I'm using Cisco 5505. The software is ver 8.2

Sent from my iPad

Re: How to create 2 DMZs

Julio Carvajal — Fri, 03 Feb 2012 21:51:47 GMT

Hello,

If you have the base license you will not be able to do it ( will need to get the security plus license)

Just in case you have the security plus license

-Interface vlan 3

-nameif dmz1

-ip add 10.0.1.1 255.255.255.0

-no shut

-security level 50

interface ethernet 0/3

switchport access vlan 3

-Interface vlan 4

-nameif dmz2

-ip add 10.0.2.1 255.255.255.0

-no shut

-security level 50

interface ethernet 0/4

switchport access vlan 4

Inside interface or vlan usually has a security level of 100 so you do not need any ACL to allow the communication, all you need is

nat (inside) 1 0 0

global (dmz1) 1 interface

global (dmz2) 1 interface

Do Rate all the helpful posts!!!

Julio

Re: How to create 2 DMZs

haroldgonzales — Mon, 06 Feb 2012 16:53:29 GMT

Thank you for the info. I appreciate it. I will try this config and will let you know.

Re: How to create 2 DMZs

JohnTylerPearce — Mon, 06 Feb 2012 17:40:07 GMT

If you set both interfaces as the same security level they will not be able to communicate by default. You can

change this with a configuration command. So if those 2 interfaces are NOT to communicate the configuration

that jcarva suggested would be an easy solution

Re: How to create 2 DMZs

haroldgonzales — Mon, 06 Feb 2012 17:41:59 GMT

Thank you. I appreciate it. I will try this and will let you know.

Re: How to create 2 DMZs

Julio Carvajal — Mon, 06 Feb 2012 17:42:27 GMT

Hello Harold,

Sure, just let me know.. I will be more than glad to help and follow up this ticket.

Regards,

Julio

Do rate all the helpful posts!!!

Re: How to create 2 DMZs

haroldgonzales — Tue, 07 Feb 2012 03:00:29 GMT

Hi,

I had tried it but still can not access it from the Internet? Would you know how the users access the DMz1 using port sftp? And Dmz2 using port 80?

My outside ip Interfaces is 12.0.12.84

Thanks

Re: How to create 2 DMZs

Julio Carvajal — Tue, 07 Feb 2012 05:24:07 GMT

Hello,

So you are running a security plus license!

Ok lets say they need to access DMZ2 web server with ip address 192.168.12.2

and DMZ1 with a SFTP server with the ip of 192.168.13.2

So he will receive inbound connections from the outside:

static (dmz1,outside) tcp 12.0.12.84 80 192.168.13.2 80

static (dmz2,outside) tcp 12.0.12.84 222 192.168.13.2 22

access-list outside_in permit tcp any host 12.0.12.84 eq 80

access-list outside_in permit tcp any host 12.0.12.84 eq 222

access-group outside_in in interface outside

Regards,

Julio

Do rate all helpful hosts

Re: How to create 2 DMZs

haroldgonzales — Tue, 07 Feb 2012 05:26:59 GMT

Thank you.. I will try this. I appreciate it.

Re: How to create 2 DMZs

haroldgonzales — Tue, 07 Feb 2012 05:28:59 GMT

Quick question: is the sftp protocol number is 222 or 22 only?

Yes, I'm using a security plus license. Thank you.

Re: How to create 2 DMZs

Julio Carvajal — Tue, 07 Feb 2012 05:53:53 GMT

Hello,

It uses port 22!

Do rate all the helpful posts!!!

Julio

Re: How to create 2 DMZs

haroldgonzales — Fri, 10 Feb 2012 03:44:41 GMT

It works well. Thanks

Re: How to create 2 DMZs

Julio Carvajal — Fri, 10 Feb 2012 04:51:45 GMT

Hello Harold,

Great to hear that, please mark the question as answered so future users can learn from this.

Regards,

Julio