THE GOAL
Cable Modem – (would like) DMZ----Cisco Router 871-----Cisco Pix 506e-----Cisco 3750—Server with 2 NIC’s
I need help with integrating this Cisco router with the currently existing Pix and networked LAN. The goal is set up a DMZ with DNS. I am not quite sure what direction to take, not sure if using VLAN’S from the router on down to the switch where the server is connected. My Server has two NIC’s the first NIC will be pointed to an internal DNS, the other NIC would point to the DMZ with an external DNS for external name resolution. I have looked on the Cisco website for the references but I don’t see anything that I can use.
Ohh and P.S
Please have some patients a gentlemen was helping me setup my switch and got annoyed with me, not his fault though I know it must be hard trying to solves problems via email. SO let have fun.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Well I think the 506E support 2 physical 2 virtual the 2 virtual are Vlan interfaces. The issues at hand is to route traffic from the routers Vlan through to the pix putting a DDNS on the DMZ I mean I am sure you can do it through access lists and routing but I was thinking that 802.11q tagging from the router on down would be the ideal situation
Other things like DMZ can be used with virtual interfaces or “Vlan’s ” and in particular the 506e series version 6.35 supports to physical interfaces and two virtual interfaces which can be setup for DMZ creating a 3 virtual interface bind to a physical interface here you will see what I mean http://www.experts-exchang
http://www.experts-exchang
I did not say I was going to set up like that. I was just saying that can be done. My true goalis to set up a forward facing DNS on the
DMZ that can resolve external names and host web servers I just want to keep the lands segment I'm not sure if and to access list from the router through the firewall down to switch with a server is connected is a solution. Because it's a dynamic IP I want to make sure that all the information can be updated externally and that the transitional update is smooth. So that's west of questions sci-fi came off the wrong way I'm still new to the game I love it though but I'm not quite sure what direction. Note that all advice given is greatly appreciated.
Mburdick's ideas are right on for the best way to do what you want. A cheaper solution would be to just use the 871 as your dmz (if it doesn't have the advanced features, you had better be good at cisco configs). You could then put upto 3 of your dmz equipment on the ports of the 871 (4th used for the uplink to the PIX - if you need more than 3 you could use the wireless, but lock it down well or disable it). Since all of the devices already use ethernet, I would probably continue to use just that protocol. Personally I would not use VLans, etc. because of the extra loads they would cause on these small devices (ie Mburdicks comments on overloading the PIX and/or the 871 are absolutely correct). The PIX will automatically allow you to access the external DNS (you would have to punch one hole in the PIXs firewall if you needed 2 way communication between the internal and external DNSs) or - If you were really good with your DNS server configs ie absolutely able to control the OSes to not route between 2 NICs - you could put 2 NICs in both the external and the internal DNS servers. (but once again if you are not good at locking the NICs down, you would create alternate unsecure routes and possible routing loops).
I'm pleasantly surprised to see that someone actually took interest in my network issue to bring everyone up to speed I decided to connect to the external DMZ and bypassed the firewall and connected it directly into the router. I worked with Cisco to make sure that my dynamic DNS settings were correct. Then I assigned the DMZ interface and IP address of 172.X.X.X and gave the external in the face on the server and IP address in this range. My next dilemma is, should I set up my internal DNS server to look at the external DNS server on the DMZ for name resolution as his DNS server will sit on the DMZ and will be in charge of name resolution for this particular zone. Can you give me any examples in reference to locking down the network interface card. It would be greatly appreciated. Thank you
Business Accounts
Answer for Membership
by: mburdickPosted on 2006-02-23 at 17:23:51ID: 16035121
The PIX 506e can support a quad port NIC or a single 100Mb NIC to give you more than two interfaces. This would give you the DMZ area that you are looking to create.
Once the DMZ exists, you can plug your server(s) in to it and build the necessary rules in the PIX to separate the outside, the DMZ, and inside all from one another.