need dmz setup help please! 2

[cahelmster]

When adding a DMZ, do you need 2 NICs on the server that will be connected to the DMZ?

Do I have to set a NAT, ROUTE, and/or GLOBAL command for the new DMZ interface? The DMZ will host an SMTP server that receives Internet email and sends out interoffice email.

All I want to do is move an existing SMTP server from the INSIDE interface to the DMZ interface...

Any help is appreciated!

 

[ChrisAC]

Why would you need two NIC's?? Just connect a switch or a hub to the DMZ interface on the fw and then patch your SMTP server into that!

Or, patch the server into the DMZ port directly with a crossover cable. I recommend the switch!

Chris.
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[cahelmster]

Being sort of new to firewalls, I can see where the DMZ interface would be effective if I ran the crossover cable directly from the DMZ card to the server, but how could connecting the DMZ card to a switch or hub provide the extra DMZ security like the crossover setup? The switch option is essentially what I'm doing now...having outside SMTP traffic go through the network to get to the SMTP server...

I want to isolate the SMTP server so that outside email will not have to travel across the network to get to the SMTP server....outside requests will go straight from the firewall off to the server...

C

 

[ForumKid]

Hi,
Im running crossover cables between my firewall and servers. I only have one server behind my dmz so there is no need for a switch. A switch is just a smart hub. Just directs traffic. HOwever I would not suggest using a hub. Switches are not sniffable yet hubs are. Most people have more than one server behind the dmz. If there is more than one server then you need a switch or router/etc.

I hope this helps and doesn't confuse the heck out of you.

 

[cahelmster]

I see now why the switch option may be necessary...thanks for all responses...it's been a big help!

 

[rubbaninja]

Using PIX 515ur, 6 interfaces, in Stateful failover... how would you hookup your DMZ to it? Multiple servers.

 

[ChrisAC]

Patch both DMZ ports (one on each PIX) to your DMZ switch.

Chris. ************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[rubbaninja]

Could I use a hub? Right now that is all I have.

Or, I have 2 catalyst 6000 series switches with 9 blades on each, both with gig blades also. Could I use it? If so, how? Set the DMZ ports to its own VLAN?

thank ya

 

[ChrisAC]

Yes, you could create a VLAN for your DMZ. No problems with that!

Chris.
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[rubbaninja]

very sweet.

Thanks a bunch for the help

-Adriana