Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

ASA Configuration / Hiding Internal IP from DMZ

Posted on 2012-03-09
3
Medium Priority
?
433 Views
Last Modified: 2012-10-11
We have an ASA 5510 and we are trying to set up a new network segment that will function as a DMZ. We want requests to ports 25 and 443 to pass through the DMZ and then onto the internal network, which is connected through another interface. I am having trouble obfuscating the internal network segment from the DMZ. I don't want to give out any information about internal network addresses to the DMZ.

Let's say our DMZ address segment is 192.168.80.0/24 and our internal address segment is 192.168.240.0/24. I have successfully created rules that allow ports 25 and 443 from the outside into the DMZ and they route to the correct servers. Now, I'd like to be able to allow our DMZ servers to connect to obfuscated addresses (either fake addresses on the same network segment or ones that don't truly exist) instead of connecting directly to 192.168.240.X.

I do not entirely know if this is possible, but if you can generally describe without asking me to output my configuration, that would be preferable.

Thanks!
0
Comment
Question by:cculver
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 17

Accepted Solution

by:
max_the_king earned 2000 total points
ID: 37704939
Hi, you cannot do that but mostly it doesn't make sense.

Your servers sit in DMZ and are separated from internal LAN: this means that you are allowing access from outsdie (internet) on them without compromising internal servers and workstations (that's fine).

By default on ASA, DMZ hosts cannot communicate with hosts behind inside interface (that's fine again), while yous internal hosts can initiate communication towards DMZ hosts.

Now, if you need to open any socket (TCP/IP connection an any port) from DMZ to internal hosts you must apply a rule (access-list and correct "nat-routing") to allow this. That is how it is supposed to work and it is fine.
It is not a security hole, just a monitored rule that allows your users do their job. If a server in DMZ gets compromised, yes, theorically from there you might try and reach your internal hosts, but it can only happen through the rule (which you must know) you have applied.

hope this helps
Max
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

596 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question