?
Solved

Need Help setting up a DMZ on a Cisco 2600

Posted on 2007-09-28
3
Medium Priority
?
376 Views
Last Modified: 2008-01-09
Have a Cisco UBR900 that connects to a Cisco 2600 that connects to a Symantec Gateway Security Device.
I need to setup a DMZ on the 2600.  I want to place a wireless device on the DMZ to allow vendors the ability to connect to the internet and download/run their specific applications, bypassing my network.

What is the syntax for doing this? (2nd interface)  Are there any complications in doing this?
0
Comment
Question by:bmsjeff
  • 2
3 Comments
 
LVL 11

Expert Comment

by:tvman_od
ID: 19981236
Do you have a spare ethernet interface on your 2600? If so, you just configure another private network with NAT and apply strict ACL on the interface which will deny all the traffic from/to your company network and permit everything else
0
 
LVL 14

Author Comment

by:bmsjeff
ID: 19981754
I have Lan1 Lan2 Lan3 Lan4 on the back of the router
0
 
LVL 11

Accepted Solution

by:
tvman_od earned 2000 total points
ID: 19981861
So you use Lan1 for your modem, Lan2 for security device and your LAN and Lan3 and for open for other applications.
I assume you have NAT configured on this router

Let's assume your DMZ will have private network 172.16.1.0/24

interface Fa0/3
  ip address 172.16.1.1 255.255.255.0
  ip access-group DMZ_in in
  ip access-group DMZ_out out
  ip nat inside

ip access-list extended DMZ_in
  deny ip 172.16.1.0 0.0.0.255 <your LAN net><your LAN wildcard>
  permit ip any any

ip access-list extended DMZ_out
  deny ip  <your LAN net><your LAN wildcard> 172.16.1.0 0.0.0.255
  permit any any

ip access-list extended NAT
  <your existing NAT ACL>
  permit ip 172.16.1.0 0.0.0.255 any

ip nat inside source list NAT interface Fa0 overload

0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

755 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question