Set up DMZ Server by Using Cisco 2921 Router and Catalyst Switches

[jivteshchahal]

We are using Cisco 2921 routers and have to connect Vlans to DMZ server and to ISP. We have done vlan interconnectivity using router at Access layer. Now we have to use router firewall between DMZ, internal Network. We have to connect to ISP and DMZ server with HTTP,FTP and TFTP services. Can you tell me about setting up router firewall , setting up NAT & PAT and getting access of Vlans to ISP and DMZ server.

[Flavio Miranda]

Hi,

  Basic steps:

Create an access-list with DMZ network
access-list 1 permit 192.168.0.0 0.0.0.255
ip nat inside source list 1 interface fa 0/1 overload

inft fa 0/0 - DMZ
ip nat inside
int fa 0/1 - ISP
ip nat outside

[jivteshchahal]

Thank you......I am having another problem. I do not want vlan 10,vlan 20,vlan 30 to access tftp, vlan 10,vlan 20 to access ftp.

[Flavio Miranda]

You can create an Access List denying port 21 and 69.

access-list 101 permit tcp IP DA VLAN any eq 21

access-list 101 permit tcp IP DA VLAN any eq 69

[jivteshchahal]

At which inter face should I use .(in or out)