static NAT device across DMZs

wilson_1234_2 — Mon, 11 Mar 2019 14:44:49 GMT

I have a new DMZ that we created for a CSS to act as a DNS server.

The CSS will need to access several other DMZs for the services to check different servers.

All of the existing DMZs are of a higher security level than that of the new DMZ.

My question is regarding the NATing across the DMZs.

Is there a rule of thumb regarding security levels when creating the NATs?

For example, it would be more efficient for me to NAT the new DMZ CSS to the other DMZs, because the other DMZs have more than one server the CSS has to poll:

New_DMZ device =

192.168.8.2

interface security level = 5

DMZ1

192.168.9.5 (server1)

192.168.9.10 (server2)

interface 192.168.9.1

security level = 10

DMZ2

192.168.10.5 (server1)

192.168.10.10 (server2)

interface 192.168.10.1

security level = 11

Does it matter that I NAT the new DMZ device to the other two DMZs, rather than the other way around?

For example:

static (New_DMZ,Dmz1) 192.168.8.2 192.168.8.2 netmask 255.255.255.255

static (New_DMZ,Dmz2) 192.168.8.2 192.168.8.2 netmask 255.255.255.255

Re: static NAT device across DMZs

celiocarreto — Tue, 03 Feb 2009 08:33:22 GMT

Hi,

to communicate between DMZs you don't need any NAT. If you apply a adequate ACL they can communicate with each other.

Regards, Celio

topic static NAT device across DMZs in Network Security

static NAT device across DMZs

Re: static NAT device across DMZs