Hoping for some clarification on using Virtual Wire to inspect traffic to our DMZ please.
Right now the external interface of our PAN has a public IP of 22.214.171.124/24.
Its default gateway is another firewall in front of it, it's internal interface has a public IP of 126.96.36.199/24.
Both of these interfaces are connected to a switch, and on that switch we also have a webserver/mail relay which have public IP's on the same 188.8.131.52/24 network, kind of like this:
PAN (external interface is in dumb switch)
Dumb Switch--DMZ Servers
Perimeter Firewall (internal interface is in dumb switch)
I know I can bring those DMZ servers in behind another interface on the PAN and assign them private IP addresses and have the PAN do the decryption/inspection/forwarding.
I also believe I can setup a DMZ "virtual wire" which will let me do SSL decryption and threat/virus inspection without having to touch the configuration on any of those DMZ servers.
What I'm not clear on is how I'd do this, and as I don't have a PAN I can test on I'd appreciate some clarification before I do anything.
Equally if every "best practise" out there is to do this using traditional NAT tell me and I'll look at doing it this way (How do I best build up the "new" ruleset on the PAN without committing it until I'm ready, whilst being able to make changes to my running config if I need to?).
Thanks for the reply. I had a chat with Vadition and they were of the view that the simplest solution (maybe more work to get there but neater/simpler) would be to bring the hosts off a L3 interface and have a DMZ zone and do inbound NAT etc.
One question on that as I only just asked them - can you assign multiple NICs in the PAN to the same L3 interface?
I ask as we only have two DMZ hosts so it'd be nice to be able to plug them directly into the PAN vs. bringing another (small) switch into the equation.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!