How to create a DMZ on Cisco ASA5505

[Sindibade 78]

Hi

Please can you tell me if ASA5505 support creating of DMZ interface? how can we configure it?

regards

Adil

[mirober2]

Hi Adil,

Here is the basic configuration you need:

interface Ethernet0/2

   switchport access vlan

   no shut

!

interface vlan

   nameif DMZ

   security-level 50

   ip address

   no shut

Keep in mind that you may also need to configure NAT, access-list, and route statements depending on your network and your requirements. If you have questions about this, feel free to let us know.

Hope that helps.

-Mike

[Jitendriya Athavale]

apart from that just one more difference

it really depends on wht license you have

restricted dmz license (default)

wherein you can allow the dmz to pass traffic to only one other interface using the command

no forward vlan number

where the number specifies that you cannot send traffic to this vlan

security plus (you need to buy this)

in this the interface will work just like others

you can read more here

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/int5505.html

[Sindibade 78]

On my ASA5505 it's have a 10 users licence when i need to set nameif i seen error message that i can't do more than 2 namif inside and outside.

[Jitendriya Athavale]

You can check the entire licese and see if you have dmz restrcited licese it s probably bcoz of that

Show version will give you licenses

If so then when you configure the third vlan even before u enter nameif enter the command

No forward vlan x

Then u will be able to

[leonnikolaou]

Hi Adil,

you will need a Cisco “ASA 5505 Security Plus Firewall Edition Bundle in order to be able to use your dmz interface.

You will have to buy this license separately in order for your dmz zone to be active.

This is license is the:

ASA 5505 Sec. Plus Lic. w/ HA, DMZ, VLAN trunk, more conns.

and as all cisco products is one-time payment, no yearly subscriptions etc.

Hope that helps.

Regards

Leon