How to create a network with DMZ ??

[winsonlee]

How can i create a network with DMZ ??

pc 1 ==> switch 1 ( ==> switch 2 ==> vpn concentrator ==> pix 525 ==> router ==> internet (IP VPN)
pc 2 ==>
pc 3 ==>

all the server will be connected to switch 2.
mail server ==> switch 2 ==> vpn concentrator ==> pix 525 ==> router ==> internet (IP VPN)
web server ==>
data server ==>

all the server and switch 2 will be in the Demilitarized Zone. is there anything wrong wif the design ?? how can i improve on this network design ?? what router can i used to connect to the internet if i am using IP VPN service frm the ISP ??

 

[ChrisAC]

If switch 1 is just patched into switch 2 then are you using VLANS? If not then you do not appear to have a DMZ if I understand your setup correctly.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[winsonlee]

if i am not using VLAN, what are the changes that i need to make to my existing design ???

 

[ChrisAC]

It all depends. What model Pix do you have?

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[winsonlee]

i am using the PIX 525...

 

[ChrisAC]

In that case you can set up another interface to be a DMZ.


Internal_Net --- [------Firewall ----] ----Ext_Router
| |
| |
Server_DMZ1 VPN_Concentrator_DMZ2

You can set up multiple interfaces on the 525 with different security levels. Your outside is sec0 and the inside is sec100 and all the other interfaces will be inbetween. Each DMZ will be on a different subnet.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[winsonlee]

(pc1, pc2, pc3) ===> switch 1 ===> Firewall ===> External Router

DMZ
---
(server1, server2, server3) ===> switch 2 ==> Firewall ==> External Router

VPN Concentrator ===> Firewall ==> External Router

is this how the design should looks ???

 

[ChrisAC]

Your diagram isn't very clear but the basic idea is that your PC's and your servers sit on different interfaces on the firewalls. The VPN concentrator can sit either parallel with the firewall or on an other firewall interface.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************