dmz

[bluesea2010]

Hi ,

I don't have a physical switch for dmz .Now If I want to  share the same  inside network switch ,what is the solution 

Thanks

[Rob Ingram]

@bluesea2010 it's not generally advisable, but if you needed to do it configure the interfaces of the DMZ VLANs and servers in a separate VRF. Which will isolate the routing, traffic would be routed via the Firewall, which would permit/deny traffic accordingly.

[Karsten Iwen]

If the infrastructure is not separate, the minimum separation is by VLANs. Depending on your implementation, also VRFs can be used to separate the data.

[bluesea2010]

Hi @Karsten Iwen  @Flavio Miranda  @Rob Ingram  @MHM Cisco World 

switch model is nexus 9k

Planning to do  dmz on dc firewall .?

 ,How the physical connection should be . ?

What If I have spine and leaf with border leaf ?.I want to run dmz  in the same  boarder leaf 

Thanks 

[Flavio Miranda]

The solution depends on the switch model and version you have.  Can you tell please?

[MHM Cisco World]

DMZ have subinterface in FW
Inside have different Subinterface in FW 

SW have two different VLAN for each DMZ and Inside.

keep notice that FW will be the GW for both these VLAN