Monday, 14 May 2012

ASA 5500 Adding a DMZ Step By Step

ASA 5500 Adding a DMZ Step By Step
Assuming you have a working ASA 5500 and you want to add a DMZ to it, this is the process.
1. Networks,
a. Inside network is
b. Outside network is
c. DMZ network is
2. Interfaces,
a. Inside Interface is
b. Outside Interface is
c. DMZ Interface is
3. The Web server in the DMZ will have the following IP addresses,
a. DMZ IP address
b. Public IP address
4. From the Internet you want to allow web traffic and secure web traffic (http/www andhttps/ssl) to the DMZ Server.
5. The DMZ Server needs to speak to a database server on the inside LAN, on TCP port 1433.
1. Firstly connect to the ASA log in and go to enable mode.
User Access Verification
Type help or '?' for a list of available commands.
PetesASA> en
Password: ********
2. Go to configure terminal mode and set up the DMZ interface (In this case Ethernet0/2).
PetesASA# conf t
PetesASA(config)# interface Ethernet0/2
PetesASA((config-if)# nameif DMZ
PetesASA((config-if)# security-level 50
PetesASA((config-if)# ip address
PetesASA((config-if)# no shutdown
PetesASA((config-if)# exit
3. I like to name the DMZ entities IP addresses so things look neat.
PetesASA(config)# name DMZ-Host-Private-IP
PetesASA(config)# name DMZ-Host-Public-IP
4. Set a some NAT statement to handle traffic flow. (assuming you have a matching global statement like global (outside) 1 xxx - "show run global" will tell you).
PetesASA(config)# nat (DMZ) 1
Note We are only going to have one DMZ host, and it will have a static mapping - if you had many DMZ hosts then also add "global (DMZ) 1 interface".
5. Now add some static mappings.
PetesASA(config)# static (DMZ,outside) DMZ-Host-Public-IP DMZ-Host-Private-IP netmask
PetesASA(config)# static (inside,DMZ) netmask
PetesASA(config)# static (inside,DMZ) netmask
6. To let people from outside you need to either create an access-list or add some rules to any existing inbound access-list. ("show run access-group" will tell you, look for an ACLapplies "in" to the outside interface e.g. "access-group outbound in interface inside". We will assume I don't have one so i'll need the access-group at the end.
PetesASA(config)# access-list inbound extended permit tcp any host DMZ-Host-Public-IP eq www
PetesASA(config)# access-list inbound extended permit tcp any host DMZ-Host-Public-IP eq https
PetesASA(config)# access-group inbound in interface outside
7. Now to allow the DMZ host to get to the database server I'm going to allow TCP 1433.
PetesASA(config)# access-list DMZ_outbound extended permit tcp host DMZ-Host-Private-IP host DMS-SQL eq 1433
g)# access-group DMZ_outbound in interface DMZ
8. Finally save the configuration.

No comments:

Post a Comment