DMZ connectivity

[prashantrecon]

As per as diagram the firewall is connected to L3 switch (inside interface ) and L2 switch(dmz interface).

On dmz we have vlan 55 .Due to port limitivity on L2 switch we have directly connected a lan cable from

L3 switch to dmz switch with vlan 55 on both switches.

Now on L3 switch I have connected a  few vmware server with vlan 55.

so now all the vm  servers are  on dmz zone.

Recently Audit was conducted by experts it was suggested this type of connectivity was not recomended.

So from my point of view i want to know what are the drawbacks of this connectivity ie connecting a lan cable

directly from L3 switch to Dmz switch.

[Jouni Forss]

Hi,

I guess it really adds some complexity to the network and in the long run makes things "harder" to manage.

I'm not sure if they gave you any specifics then if they specifically mentioned this.

Personally I would try to keep the connections between firewall and its connected devices as simple as possible.

Could consider

• Using single physical interface as Trunk to Core and bring all Vlans through that
  • Connect access switches directly to Core
• Configure Etherchannel between Firewall and Core if traffic through the different Vlans is high
  • Connect access switches directly to Core
• Connect another switch to the DMZ switch and remove the connection between the Core/LAN and DMZ

Naturally you would have to make changes that would cause some kind of outage in the server connections.

- Jouni

[prashantrecon]

Hi 

Thanks for the answer.

I have suggest for the diffrenet switch but mangemet is asking the drawbacks could u please suggest.

One ot them we faced is dos attacks.

there was dos attack on vmware server the result was entire network was down.

Please suggets some drawbacks

[Jouni Forss]

Hi,

If your servers have been targeted by DOS attack and the cause of network outage has simply been the amount of traffic eating your bandwith I dont think changing the mentioned network setup will change it for any better or that the current setup is to blame for it.

Or was there some other problem than the attack eating up your bandwith? Was the server just unsable and was also critical for your LAN users connections?

My suggestions in the earlier post were purely from my own perspective of keeping the network simple.

I would imagine if someone audits your network and tells you that your setups is somehow wrong that they would be the one to tell you whats specifically is wrong and are the drawbacks of the setup.

- Jouni

[mvsheik123]

Hi Prashant,

What audit experts said was correct. In general, you place the servers in DMZ to provide secure access from Internet and at the same time to secure internal network/servers accessing from internet. In your scenario you have a direct connection from DMZ to Inside switch (bypassing your firewall and defeats the fw purpose). So, there is a chance if one of your DMZ server compromises, it can easily inpact internal servers/infrastructure. I suggest you replace the DMZ sw with reqd port density. Also makes sure that all your servers patched upto date- as its not always 'network' related issues.

hth

MS

[prashantrecon]

Thanks  a lot. Would suggest the same.

[Jouni Forss]

Hi,

Either I have missunderstood something or completely missed something

But it seems to me that the DMZ Vlan is taken from all the way from Firewall -> L2 switch -> L3 switch -> Server. If we presume that the L3 gateway for the servers is the firewall the DMZ servers will not be bypassing the firewall when it comes to the traffic from the Vlan55 to any other Vlan on the network.

Naturally if you do have some L3 point for the Vlan55 on the L3 switch its a totally different matter. But if the Vlan55 is just a L2 segment that ends at the firewall every server is using the firewall to connect to anything else outside their network.

Though the fact still remains that the setup isnt ideal if you need to start making connections between devices because you are out of switch ports.

And if there is some sort of DOS attack or the server starts generating traffic that eats up all your Internet bandwith you might still end up loosing all connectivity no matter where the servers are behind your firewall.

- Jouni

[prashantrecon]

Hi jouniforss,

This is My config on firewall ,l2 and l3 switch

on firewall config

int gi0/2

nameif dmz

ip address 192.168.10.1

security level 50

on l2 switch vlan 55 is created and port is assigned to vlan 55

on l3 nswitch again vlan55 is created  and port is assigned to valn 55.

As mentioned earlier a cable is directly connected from l3 switch to l2 switch with vlan 55 on both the ports.

Due to port limitivity on l2(dmz  switch ). On l3 switch server are assigned to vlan 55 with ip eg 192.168.10.2

mask 255.255.255.0 gateway 192.168.10.1

This is scenario so is there any draw backs?