DMZ question

[m.saunders]

                   Am I able to apply an ACL within the same DMZ to prevent one host from talking to another............in that same DMZ.

DMZ X:

172.17.1.1 is allowed to talk to the internet and to internal hosts BUT,

Denied from talking to 172.17.3.3 which is on the same DMZ

Can I just do a:

permit ip host 172.17.1.1 any port whatever

deny ip host 172.17.1.1 host 172.17.3.3

Thanks

[Derron Carstensen]

In theory no...

The reason being if the destination resides in the same layer three boundary (same subnet) then the source will do an ARP request and find the destinations MAC.  From there the source node will send the data directly to the destination's MAC.

There is no man in the middle (firewall) to filter this traffic.  If you were routing between networks and the firewall was in the middle it would work.

[m.saunders]

So if we put both devices in 2 different DMZ's we can then apply ACL's around them and protect them from one another?  Do they have to be in different subnets as well?

[Derron Carstensen]

Yes if you place them in two different DMZs (which would also be different subnets) then you can use ACLs on the firewall to allow/block specific traffic.

[m.saunders]

Thanks

[Ramraj Sivagnanam Sivajanam]

Hi Bro

You can't deny network traffic when the source and destination are in the same network address. However, if you still want to block access between these 2 devices (assuming both these devices are physically connected to the same Cisco L2 switches), you'll need to configure Private VLAN, on those switchports. This will work like a charm.

http://www.cisco.com/en/US/tech/tk389/tk814/tk840/tsd_technology_support_sub-protocol_home.html

P/S: If you think this comment is useful, please do rate them nicely :-)

[m.saunders]

I'm not a bro but thank you for the response!!  LOL  This helps in my configuration.

Michelle