topic Multiple DMZ setup question in General Topics

Multiple DMZ setup question

iguarino — Fri, 05 Oct 2012 16:57:33 GMT

Hello,

I'm looking to create 2 dmz's on the PAN as separate networks. This is how I have it envisioned and would appreciate any feedback.

1. configure two layer 3 interafaces with GW IP assigned
2. assign security zone to each interface
3. attach each interface to existing VR
4. route internal dmz address networks to each interface in VR
5. set security and nat policies as appropriate

I know I could configure the interfaces as layer 2 as spelled out in the L2 networking pdf, but I'm unable to do that in this situation. Are there any considerations I should be aware of? My existing VR is used for VPN tunnels only. Should I consider a separate VR?

Thanks,
Ian

Re: Multiple DMZ setup question

sdurga — Fri, 05 Oct 2012 20:31:50 GMT

You are in the right path, can you please brief the problem you are facing with the config ?. Are u not able to configure L3 interfaces or what is the problem that you are facing? You do not need two VR's for this. One virtual router should be fine.

Thanks,

Sandeep T

Re: Multiple DMZ setup question

kalavi — Fri, 05 Oct 2012 23:22:45 GMT

Hi Ian,

As per the description, I am assuming you might be doing the following:

1) Tying to add L3 interface and L2 in the same DMZ zone: It might not be possible because the Zones are defined based on Zone type, they should be either layer 3 or layer 2 or vwire or tap, we can not create a combination out of it.

2) If the above assumption is wrong, the next thing I can assume is that you are trying to configure two DMZ zone with same name but one for layer 3 and another for layer 2, that would also not be possible because by design we can not have two zone with same name even though they are of different type.

Let us know if you are trying something else, we would try our best to respond you back as soon as possible.

Thanks,

Khubaib Alavi

Re: Multiple DMZ setup question

iguarino — Thu, 11 Oct 2012 12:58:41 GMT

Thanks guys. The issue was a bad configuration on the vmhost side. I just wanted to get a sanity check on my side of the config.