topic Re: Multiple DMZ ASA help in Network Security

Multiple DMZ ASA help

patelvc7601 — Mon, 11 Mar 2019 16:29:38 GMT

We have ASA 5520 Cisco Adaptive Security Appliance Software Version 7.2(3).

Current Config for DMZ is :

interface GigabitEthernet0/2

nameif dmz

security-level 50

ip address x.x.x.1 255.255.255.0

==================================

I am using all the physical port & need to add another DMZ Segment. I am planning to configure following :

int gi0/2

no nameif dmz

no ip add x.x.x.1 255.255.255.0

int gi0/2.35

nameif dmz

vlan 35

security-level 50

ip add x.x.x.1 255.255.255.0

int gi0/2.36

nameif dmz2

vlan 36

ip add y.y.y.1 255.255.255.0

====================================

I have few question regarding above configuration .

1 Am I on right path or not ?

2 When I will remove dmz from Physical interface to logical interface , what happen to my access-list associated with dmz interface ? do I need to recreate it or moving to logical interface will take care of the config automatically.

Thank you

Viral Patel

Re: Multiple DMZ ASA help

scott-goodwin — Thu, 22 Oct 2009 12:24:42 GMT

I beleive you will have to recreate the access-group command to re-apply the access-list as the name removal will delete the associated access-group command.

Thanks

Scott

Re: Multiple DMZ ASA help

patelvc7601 — Thu, 22 Oct 2009 13:12:48 GMT

I have currently this command applied to access-list dmz_inbound will apply to nameif interface dmz. I am assuming once I make above changes I may have to just reapply .

access-group dmz_inbound in interface dmz

Thank you

Viral Patel