Book Excerpt: Cisco Secure Internet Security Solutions - part 4
Are you considering the purchase of a Cisco firewall, or looking at issues involving configuring one? This excerpt from the Cisco Press book, Cisco Secure Internet Security Solutions, deals with their Secure Private Internet Exchange Firewall, or PIX. Part 4 of Chapter 4 covers Single DMZ configuration, which moves the FTP, Web, and e-mail servers to a DMZ. All traffic destined for these servers will not touch the LAN.
Cisco Secure Internet Security Solutions - Chapter 4
by Andrew Mason, Mark Newcomb
Cisco Secure PIX Firewall - Part 4
The next configuration adds a DMZ and allows configuration of the PIX through something other than the console. The configuration also enables SNMP, a syslog server, and filter URLs.
Single DMZ Configuration
This configuration moves the FTP, Web, and e-mail servers to a DMZ. All traffic destined for these servers will not touch the LAN. When using a DMZ, it is critical that no connection between the LAN and the DMZ be maintained except through the PIX Firewall Connecting the LAN to the DMZ in any way except through the firewall defeats the purpose of the DMZ. Figure 4-7 shows that a third interface has been added to the PIX. This interface will be used as a DMZ.
Figure 4-7: Single DMZ Configuration
(Click image for larger view in a new window)
The configuration will need a few changes from the previous one. Look through the following configuration. This section will discuss where changes have been made and the ramifications of those changes after the configuration. As before, the blank lines are for clarity.
