Standard network design

[_bmal]

I'm configuring a network that that follows the standard inside-outside-dmz design.

On the inside, I have my workstations, on the outside, I have my ISP and on the DMZ I have my servers. I've configured IP addressing and routing (RIP). I understand that the inside has restricted access to the DMZ and outside, the outside has restricted access to the DMZ and the DMZ has restricted access to the inside and outside. I've placed a router to act as the firewall that separates the 3 sections but I'm not sure how to go about configuring it. I know I could use an ACL but I'm not sure what to permit/deny.

[Joseph W. Doherty · Accepted solution]

Outbound flows (inside=>DMZ, inside=>outside or DMZ=>outside) have the least restrictions, if any, but that's not always a given.

Generally, you logically start by blocking all access (BTW the default of any Cisco ACL), again perhaps only for outbound, and only allow what's really required. I.e. identify what doesn't work, then if verified it's required, allow it.

With ACLs, two features that can be useful are to allow inbound TCP traffic that's tagged as being part of an existing flow and often router ACLs offer a "reflector" feature, that allows an inbound packet that's a "mirror" of an earlier (allowed) outbound packet.

Further, router IOS often supports a FW feature set which can provide many of the features of a dedicated FW.

BTW, sometimes a useful feature, within a DMZ, is a switch that supports private VLANs (which blocks direct host to host communication).