DMZ switch standard configuration

[Sagar Hiremath]

Hi Team,

I'm currently working on creating a standard configuration for switches connecting the firewalls (DMZ Switch). Can you please suggest what would be considered as the most important commands that can be used in this scenario? Apart from the usual access and trunk ports. 

Also please provide any reference page where i can find the recommended configurations.

Your insights will be much appreciated!

Regards,

Sagar Hiremath

[STEPAN JANKOVIC · Accepted solution]

Hello,

DMZ switch usually provides the same level of connectivity services as other switches. So if you are able to properly (there are some best practices) configure "trunks and access ports" and  etherchannels, you will be able to provide basic function. I am sure, that your switch will be configured only for L2, no routing.

What is additional factor in DMZ is security. You have to protect the switch from being accessible from untrusted or potentially insecure networks. You have to protect management conectivity by securing acess to VTY by access-lists, limiting connectivity to connectivity from trusted management networks and only using secure protocols. This is only base requirement. You should protect also data plane against unwanted traffic. There is a lot what can be done to "harden" cisco device. You shoud start here:

https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html

Good luck!

Stepan

[Sagar Hiremath]

Thank you Stepan!

- Sagar Hiremath