One of my clients have a GSS4900 pair for some services inside their network. Now they would ike also to use the GSS for Internet related services. The GSS pair is on the inside of the firewall and we are of course reluctant to open for DNS traffic from internet to the inside even though it's just to the GSS.
Can we use keep Ethernet 0 on the inside and config Ethernet 1 to be located on for example a DMZ if just set up proper routing in it?
my idea was something like this
interface ethernet 0
ip address 10.16.0.15 255.255.255.0
gss-communications
interface ethernet 1
ip address 212.214.212.10 255.255.255.0
ip route 10.0.0.0 255.0.0.0 10.16.0.1
ip route 0.0.0.0 0.0.0.0 212.214.212.1
The idea being that this would keep the gss inter-communication and dns service for inside on ethernet0 and ethernet1 would just answer dns requests.
Good or bad idea?
