topic DMZ network configuration in General Topics

DMZ network configuration

sjlee — Mon, 16 Apr 2012 05:59:36 GMT

We have installed PAN-2050 in my customer site.

It has been deployed with two L2 interface as vmwire.

And we made one L3 vlan interface for secondary IP.

There are 2 IP subnets. (192.168.10.0/24, 192.168.1.0/24)

One(192.168.10.0/24) is for user.

The other(192.168.1.0/24) is for DMZ server.

Both IP subnet set gateway as PAN L3 vlan interface.

And one VR is in PAN-2050 for its gateway.

User subnet which uses NAT policy can use internet and intranet service as well.

Problem is DMZ server couldn't use their service.

There are no security policy.

Maybe my configuration is wrong.

Please let me know what should I add any other configuration.

Re: DMZ network configuration

rmonvon — Mon, 16 Apr 2012 18:48:27 GMT

Can the servers reach the users? or is the problem just the servers not getting access to the Internet?

Re: DMZ network configuration

sjlee — Tue, 17 Apr 2012 00:22:13 GMT

yes, server and users can communicat each other.

Server has a problem to access to internet.

Re: DMZ network configuration

rmonvon — Tue, 17 Apr 2012 04:23:04 GMT

You should check your NAT rule to ensure the DMZ zone/address is included.

Also, you mentioned there is no security policy. The implicit deny all rule will block all traffic that does not match a security rule. You should have a security rule to allow traffic from DMZ to Internet.

Thanks.

Re: DMZ network configuration

sjlee — Tue, 17 Apr 2012 04:50:35 GMT

The issue has been solved with no tcp-reject-non-syn option.

PA looked it as asymetric routing because syn is L3 flow and syn/ack is L2 flow.

Re: DMZ network configuration

rmonvon — Tue, 17 Apr 2012 14:06:37 GMT

glad to hear it.

If this PA device is the only firewall in used, I recommend that you re-enable the 'tcp-reject-non-syn' as soon as possible and not leave it off for long. You should re-design the network to separate the user and DMZ zones into its own L3 zone, and remove the L2. This will permit you to enforce 'tcp-reject-non-syn' for security reason.

Thanks.