how-to block ads
|
| | | | FAQ Revisions | Editors: skj  , Covenant , aryoba , Phraxos
Last modified on 2009-06-29 08:36:07
| |
|
|
50.4 Running Servers with Cisco·Router configuration to run server (port forwarding)
·PIX Firewall/ASA configuration to run server (port forwarding)
·Separate Internet: Dedicate T1/E1 for server, dedicate DSL/Cable for LAN
| | | Suggested prerequisite reading
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
For illustration purposes, I use:
* Cisco 806 router (2 Ethernet ports)
* ISP provided static IPs
* ISP provided DNS
* PPPoE (have to put username and password to connect to ISP)
Note:
1) When your ISP doesn't use PPPoE
If your ISP does not use PPPoE, this configuration can be easily modified to suit other type of ISP connections (i.e. Static, DHCP, PPPoA). Check out other part of this forum's FAQ for such situation.
Various PPPoE/PPPoA/DHCP/Static Sample Configuration with Cisco
2) For servers other than FTP
Also for illustration purposes, I run FTP server behind the router. This configuration can be modified to also have web server, mail server, or just any public servers that run on specific TCP or UDP port/ports. When you run web server, you can replace the TCP port 20 and 21 with TCP port 80 (the standard web port). As for mail server, replace with TCP port 25 (the standard mail port). For other servers, confirm your software configuration of the TCP/UDP port it uses.
Background
Just a bit of explanation. E0 interface is for inside network (LAN interface). E1 is for outside (ISP or WAN physical interface). Dialer1 is for PPPoE (the "actual"/logical WAN interface). The 1.0.0.13 is ISP provided static IP address for the use of the server. This configuration example is for running FTP server, which uses the standard TCP port 20 and 21.
The LAN uses 10.10.10.0 network with 255.255.255.0 subnet for both servers and workstations. All servers within the LAN use static IP address. The router is configured as DHCP server to give out IP info (IP addresses, subnet mask, DNS) to workstations that are configured as DHCP client.
Basically I suggest that you deploy NAT (Network Address Translation) and/or PAT (Port Address Translation) to setup your own servers behind Cisco router. In this sample configuration, there will be two PAT in place between Public and Private IP addresses. One is dynamic PAT which uses single Public IP address for all local workstations. Another one is static PAT which uses single Public IP address for servers.
When using NAT/PAT, keep in mind that the Internet-accessible servers are seen from the Internet as their NAT/PAT-ed IP address (the Public IP address) and not the local IP address (not the Private IP address). The connection from the Internet users to the Public IP address will then be forwarded by the NAT/PAT device, which in this case is the router, according to the router's routing table. In other words, the router will (TCP/UDP) port forward connection from the Public IP address to the actual Private IP address after proper network's routing table is in place. This understanding is very important when you or someone need to test connectivity to the server and/or when you need to create filter (access list or ACL for short) to allow only certain incoming traffic from the Internet and block others.
Side Note:
For more info on NAT/PAT concept, check out the following FAQ
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
Instruments used in this illustration are pretty much standard for running your own servers. Please note that IP addresses, username, and password are changed. However, you could always modify the configuration to suit your situation.
This sample configuration assumes that you have a block of IP addresses from ISP. There is a dedicated Public IP address for the router WAN interface (the Dialer1 interface) and another dedicated Public IP address for the server PAT IP address. In this sample configuration, typical users from 10.10.10.0/24 network are dynamically PAT-ed to the Dialer1 interface IP address when the users are going out to the Internet. When the 10.10.10.2 machine need to go out to the Internet or need to communicate with users on the Internet, then the 10.10.10.2 is statically PAT/NAT-ed to the 1.0.0.13 Public IP address.
If you only have single Public IP address for both router WAN interface and server PAT IP address instead of a block of IP addresses, there are several ways to configure the router.
One way is to use the same command as shown in sample configuration.
This one configuration way is suitable when you have static IP address from your ISP and you know exactly what the IP address is. In this case you have the 1.1.1.14 single static IP address for both the WAN interface and Public server IP address. Note that the command above shows the static PAT between Public IP address (the 1.1.1.14) and Private IP address (the 10.10.10.2).
When you are unsure which IP address you receive from the ISP, or when your Public IP address keep changing; then another way to configure the static PAT is following
With situation of dynamic IP address, at some point you still need to know the exact Public IP address you receive from your ISP for server connection testing and production time. To find out, you can issue show ip interface brief command on the router. You will then see the associated WAN interface Public IP address. Note that the command above shows the static PAT between the Dialer1 interface Public IP address (the one that shows on the show ip interface brief display) and Private IP address (the 10.10.10.2).
Between Static and Dynamic IP Address Assignment for LAN Machines
Typically, servers are having static IP addresses where regular workstations are having dynamic IP addresses. As mentioned, all LAN machines (including servers and workstations) are within 10.10.10.0/24 subnet. Let's say you dedicate 10.10.10.1 for router, 10.10.10.2 - 10.10.10.14 for servers, and the rest (10.10.10.15 - 10.10.10.254) for workstations.
This illustration assumes all workstations are receiving dynamic IP address (as DHCP client) from router which is acting as the LAN DHCP server; as indicated by the ip dhcp pool CLIENT command. Since router and servers are having static IP addresses, you exclude 10.10.10.1 - 10.10.10.14 from DHCP pool. This is where you need the ip dhcp excluded-address 10.10.10.1 10.10.10.14 command in place.
For routers that only have one Ethernet port
As mentioned, this sample configuration uses 2-Ethernet-port router. In cases that your router have one Ethernet port as LAN side and one DSL (ATM) port as WAN side, you could check out the following link:
Configuring Network Address Translation and Static Port Address Translation to Support an Internal Web Server
From the link, you can see how similar and how different the configurations are.
Tips
* You can use any computer, running any operating system with any generic FTP or other server software. There is no exclusiveness
* Make sure that the ports you plan to use are not used by other program.
* Also make sure that your ISP does not block the port you plan to use
* You can use generic port scanner software to find out if the port you plan to use is available
* Setup the FTP software to have the FTP server to use port 21 (standard port)
* FYI, port 21 only handle the connection and data is sent over port 20. With both ports PAT'd you will be able to use both PASV & PORT connections to your FTP server
* To verify the configuration, access the server from OUTSIDE network (i.e. from the Internet) and NOT from your own LAN. For this illustration, run an Internet browser (Internet Explorer, Netscape) and open »ftp://1.0.0.13:21
The Sample Configuration
Finally, here is the "show running-config" output.
Command Adjustment for Specific Needs
The above sample configuration shows how to provide FTP access to public. When you need to provide other access type such as Web or Mail, following is the command adjustment needed.
To run Public Web Server, following is the command
To run Public Mail Server, following is the command
To run both Public Web and Mail Server that resides on different LAN machines, following is the list of commands.
where 10.10.10.2 is the Mail Server and 10.10.10.3 is the Web Server.
To run both Public Web and Mail Server that resides on different LAN machines and each has its own Public IP address, following is the list of commands.
where 10.10.10.2 is the LAN Mail Server and 1.0.0.12 is the Public Mail Server. Similarly, 10.10.10.3 is the LAN Web Server and 1.0.0.13 is the Public Web Server.
If you like to dedicate 1.0.0.12 only for 10.10.10.2 machine and to dedicate 1.0.0.13 only for 10.10.10.3 machine, then you can do Static NAT instead as follows.
With such Static NAT implementation, you should have inbound ACL on the router WAN interface or some Internet firewall to regulate which inbound Internet traffic that can access those dedicated Public IP addresses for better network security. Following is a sample.
»Cisco Forum FAQ »Basic Internet Firewall ACL for Routers without IOS image Firewall feature
Having Servers on DMZ
Scenario 1: NAT/PAT for both DMZ and Inside networks
Let's say there is DMZ network of 10.10.10.0/24 where the Inside network is 10.0.0.0/24. Traffic between DMZ and Inside networks pass as they are, therefore there is no need to NAT Inside network to access DMZ and vice versa. DMZ network is only allowed to access Inside DNS server (the 10.0.0.2 IP address) and no other Inside hosts while the DMZ network is allowed to access anything Outside (the Internet). Such access is regulated by the ACL 100.
Following is the sample configuration.
Scenario 2: NAT/PAT only for Inside network, no NAT/PAT for DMZ network
So far the presented sample configurations use 1.0.0.8/29 as the NAT/PAT IP subnet. In this sample configuration, there is an addition IP subnet of 1.0.0.0/30. The 1.0.0.0/30 is used as the NAT/PAT IP subnet for Inside network. DMZ network does not use NAT/PAT at all, instead the DMZ network uses the 1.0.0.8/29 directly.
The idea behind this setup is to avoid unnecessary DNS BIND to resolve DMZ server name to both Public IP and Private IP addresses. With DMZ network having the Public IP address of 1.0.0.8/29 directly assigned, DMZ server DNS name resolves to always its associated Public IP address regardless of where the incoming traffic come from, either from the Internet or from the Inside network. More info on this issue can be found in the following FAQ.
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
Now let's describe the network setup. The 1.0.0.8/29 IP subnet is assigned directly to all DMZ machines. A 1.0.0.14 is used as the DMZ network default gateway, which is also the router DMZ interface IP address. The Inside network is 10.0.0.0/24. Traffic between DMZ and Inside networks pass as they are, therefore there is no need to NAT Inside network to access DMZ and vice versa. DMZ network is only allowed to access Inside DNS server (the 10.0.0.2 IP address) and no other Inside hosts while the DMZ network is allowed to access anything Outside (the Internet). Such access is regulated by the ACL 100.
There is no NAT/PAT in place for DMZ network to go out to the Internet. There is NAT/PAT in place for Inside network to go out to the Internet. All Inside network machines are PAT-ed to 1.0.0.2 IP address to go out to the Internet, which is the router WAN interface IP address.
The DMZ network still hosts FTP server, which is directly assigned 1.0.0.13 IP address. For security, there is ACL 101 to permit only necessary incoming traffic from the Internet and block others.
Following is the sample configuration.
More Sample Configuration
»Cisco Forum FAQ »Configure DMZ on routers
»Cisco Forum FAQ »Internet - Router - PIX - LAN
 feedback form
 feedback form
by aryoba
last modified: 2009-05-29 09:14:02 | | | Suggested prerequisite reading
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
For illustration purposes, I use:
* Cisco PIX Firewall 501 (2 Ethernet ports) running PIX OS version 6.3(3)
* ISP provided static IPs
* ISP provided DNS
* Static WAN IP addresses, provided by ISP
Note:
1) When your ISP doesn't use Static IP Address
If your ISP does not use Static IP Address, this configuration can be easily modified to suit other type of ISP connections (i.e. DHCP, PPPoE, PPPoA). Check out other part of this forum's FAQ for such situation.
Various PPPoE/PPPoA/DHCP/Static Sample Configuration with Cisco
2) For servers other than FTP
Also for illustration purposes, I run FTP server behind the router. This configuration can be modified to also have web server, mail server, or just any public servers that run on specific TCP or UDP port/ports. When you run web server, you can replace the TCP port 20 and 21 with TCP port 80 (the standard web port). As for mail server, replace with TCP port 25 (the standard mail port). For other servers, confirm your software configuration of the TCP/UDP port it uses.
3) For ASA or PIX Firewall running OS version 7.0 or later
PIX OS version 6.3(3) commands are pretty much similar to the ASA or PIX OS version 7.0 or later. Should you need more sample configurations from different angle or sample configurations on ASA or PIX running OS version 7.0 or later, keep reading to get the preliminary concept overview then proceed to the next discussion.
Background
Just a bit of explanation. E0 interface is for outside network (ISP or WAN physical interface). E1 is for inside (LAN interface).
The ISP-provided IP Block is 1.1.1.9/24 - 1.1.1.14/24, where 1.1.1.9 is for the Internet traffic, 1.1.1.13 is for the server, and 1.1.1.14 is the PIX WAN interface IP address. The default gateway (the ISP) is 1.1.1.1/24.
This configuration example is for running FTP server, which uses the standard TCP port 20 and 21. You need to permit inbound traffic from the Internet to your LAN by issuing the access-list INBOUND permit tcp any host 1.1.1.13 range 20 21 command.
The LAN uses 10.10.10.0 network with 255.255.255.0 subnet for both servers and workstations. All servers within the LAN use static IP address. The PIX is configured as DHCP server to give out IP info (IP addresses, subnet mask, DNS) to workstations that are configured as DHCP client.
Basically I suggest that you deploy NAT (Network Address Translation) and PAT (Port Address Translation) to setup your own servers behind Cisco PIX Firewall. In this sample configuration, there will be two PAT in place between Public and Private IP addresses. One is dynamic PAT which uses single Public IP address for all local workstations. Another one is static PAT which uses single Public IP address for servers.
When using NAT/PAT, keep in mind that the Internet-accessible servers are seen from the Internet as their NAT/PAT-ed IP address (the Public IP address) and not the local IP address (not the Private IP address). The connection from the Internet users to the Public IP address will then be forwarded by the NAT/PAT device, which in this case is the ASA/PIX Firewall, according to the ASA/PIX Firewall's routing table. In other words, the ASA/PIX Firewall will (TCP/UDP) port forward connection from the Public IP address to the actual Private IP address after proper network's routing table is in place. This understanding is very important when you or someone need to test connectivity to the server and/or when you need to create filter (access list or ACL for short) to allow only certain incoming traffic from the Internet and block others.
Specifically for firewall devices such as PIX Firewall and ASA, creating such ACL to regulate incoming traffic initiated from the Internet to local LAN is required. On this sample configuration, this ACL is called INBOUND (access-list INBOUND).
Side Note:
For more info on NAT/PAT concept, check out the following FAQ
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
Instruments used in this illustration are pretty much standard for running your own servers. Please note that IP addresses, username, and password are changed. However, you could always modify the configuration to suit your situation.
This sample configuration assumes that you have a block of IP addresses from ISP. There is a dedicated Public IP address for the PIX WAN interface (the Outside interface) and another dedicated Public IP address for the server PAT IP address. In this sample configuration, the network uses 1.1.1.13 IP address as the server Public IP address where the server inside Private IP address is 10.10.10.2. Any other machines use 1.1.1.9 Public IP address to go out to the Internet.
Note that the static PAT is indicated by the static command where the dynamic PAT is indicated by the pair of global and nat commands. You can change the IP address either on the static, global, or nat commands to suit your need or situation.
If you only have single Public IP address for both PIX/ASA Outside interface and server PAT IP address instead of a block of IP addresses, then you use the following commands instead.
With situation of dynamic IP address, at some point you still need to know the exact Public IP address you receive from your ISP for server connection testing and production time. To find out, you can issue show ip address command on the PIX. You will then see the associated outside interface Public IP address.
Note that the static commands above show the static PAT between outside (WAN) interface Public IP address (the one that shows on show ip address command) and Private IP address (the 10.10.10.2).
Between Static and Dynamic IP Address Assignment for LAN Machines
Typically, servers are having static IP addresses where regular workstations are having dynamic IP addresses. As mentioned, all LAN machines (including servers and workstations) are within 10.10.10.0/24 subnet. Let's say you dedicate 10.10.10.1 for the PIX, 10.10.10.2 - 10.10.10.14 for servers, and the rest (10.10.10.15 - 10.10.10.254) for workstations.
This illustration assumes all workstations are receiving dynamic IP address (as DHCP client) from the PIX which is acting as the LAN DHCP server; as indicated by the dhcpd address 10.10.10.15-10.10.10.254 inside command. Since the PIX and servers are having static IP addresses, you exclude 10.10.10.1 - 10.10.10.14 from DHCP pool. This is why the 1st DHCP IP address within the pool is 10.10.10.15 and the last one is 10.10.10.254
Tips
* You can use any computer, running any operating system with any generic FTP or other server software. There is no exclusiveness
* Make sure that the ports you plan to use are not used by other program.
* Also make sure that your ISP does not block the port you plan to use
* You can use generic port scanner software to find out if the port you plan to use is available
* Setup the FTP software to have the FTP server to use port 21 (standard port)
* FYI, port 21 only handle the connection and data is sent over port 20. With both ports PAT'd you will be able to use both PASV & PORT connections to your FTP server
* To verify the configuration, access the server from OUTSIDE network (i.e. from the Internet) and NOT from your own LAN. For this illustration, run an Internet browser (Internet Explorer, Netscape) and open »ftp://1.0.0.13:21
The Sample Configuration
Finally, here is the "show running-config" output.
Note that the static command is where the port forwarding actually takes place between the Public and the Private IP address on specific TCP or UDP port. The ACL INBOUND is only a filter to permit certain incoming traffic initiated from Outside (the Internet).
Command Adjustment for Specific Needs
The above sample configuration shows how to provide FTP access to public. When you need to provide other access type such as Web or Mail, following is the command adjustment needed.
To run Public Web Server, following is the command list
To run Public Mail Server, following is the command list
To run both Public Mail and Web Server where each server resides on different LAN machines, following is the command list.
where 10.10.10.2 is the LAN Mail Server and 10.10.10.3 is the LAN Web Server.
To run both Public Mail and Web Server where each server resides on different LAN machines and each server has its own Public IP address, following is the command list.
where 10.10.10.2 is the LAN Mail Server and 1.1.1.12 is the WAN (Public) IP address. Similarly, 10.10.10.3 is the LAN Web Mail Server and 1.1.1.13 is the Public IP address.
If you like to dedicate specific Public IP address for specific LAN machines, then you can implement Static NAT instead as follows.
where you dedicate 1.1.1.12 only for 10.10.10.2 machine and dedicate 1.1.1.13 only for 10.10.10.3 machine.
Having Servers on DMZ
Scenario 1: NAT/PAT for both DMZ and Inside networks
This time there is DMZ network of 10.10.10.0/24 where the Inside network is 10.0.0.0/24. Traffic between DMZ and Inside networks pass as they are, therefore there is no need to NAT Inside network to access DMZ and vice versa. DMZ network is only allowed to access Inside DNS server (the 10.0.0.2 IP address) and no other Inside hosts while the DMZ network is allowed to access anything Outside (the Internet).
Note that the access-list DMZ only applies when connections are initiated from DMZ machines. Any connections initiated from other network such as Inside and Outside won't be affected by this access-list DMZ.
Following is the sample configuration.
Scenario 2: NAT/PAT only for Inside network, no NAT/PAT for DMZ network
So far the presented sample configurations use 1.1.1.9/24 - 1.1.1.14/24 as the NAT/PAT IP subnet. In this sample configuration, there is an addition IP subnet of 1.0.0.0/30. Instead of using 1.1.1.9/24 - 1.1.1.14/24, this sample configuration uses 1.1.1.8/29. The 1.0.0.0/30 is used as the NAT/PAT IP subnet for Inside network. DMZ network does not use NAT/PAT at all, instead the DMZ network uses the 1.1.1.8/29 directly.
The idea behind this setup is to avoid unnecessary DNS BIND to resolve DMZ server name to both Public IP and Private IP addresses. With DMZ network having the Public IP address of 1.1.1.8/29 directly assigned, DMZ server DNS name resolves to always its associated Public IP address regardless of where the incoming traffic come from, either from the Internet or from the Inside network. More info on this issue can be found in the following FAQ.
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
Now let's describe the network setup. The 1.1.1.8/29 IP subnet is assigned directly to all DMZ machines. A 1.1.1.14 is used as the DMZ network default gateway, which is also the PIX Firewall DMZ interface IP address. The Inside network is 10.0.0.0/24. Traffic between DMZ and Inside networks pass as they are, therefore there is no need to NAT Inside network to access DMZ and vice versa. DMZ network is only allowed to access Inside DNS server (the 10.0.0.2 IP address) and no other Inside hosts while the DMZ network is allowed to access anything Outside (the Internet). Such access is regulated by the ACL DMZ.
There is no NAT/PAT in place for DMZ network to go out to the Internet. There is NAT/PAT in place for Inside network to go out to the Internet. All Inside network machines are PAT-ed to 1.0.0.2 IP address to go out to the Internet, which is the PIX Firewall Outside interface IP address.
The DMZ network still hosts FTP server, which is directly assigned 1.1.1.13 IP address. For security, there is ACL INBOUND to permit only necessary incoming traffic from the Internet and block others.
Following is the sample configuration.
More Sample Configurations
As mentioned, PIX OS version 6.3(3) commands are pretty much similar to the ASA or PIX OS version 7.0 or later. Should you need more sample configurations from different angle or sample configurations on ASA or PIX running OS version 7.0 or later, you can check out the following links.
Run Mail Server on DMZ Network
PIX running OS 6.3 image
PIX/ASA running OS 7.0 image or newer
Run Mail Server on Inside Network
PIX running OS 6.3 image
PIX/ASA running OS 7.0 image or newer
Run Mail Server on Outside Network
PIX running OS 6.3 image
PIX/ASA running OS 7.0 image or newer
PIX Firewall - Router Combo
»Cisco Forum FAQ »Internet - PIX - Router - LAN
»Cisco Forum FAQ »Internet - Router - PIX - LAN
Some Discussions
»[Config] cisco 5520
feedback form
feedback form
by aryoba
last modified: 2009-05-29 09:14:33 | | | Suggested Prerequisite Reading
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
Traditional Approach
Currently you have T1/E1 circuit for Internet access of both LAN users and servers. Due to bandwidth consumption, you decide to dedicate the T1/E1 circuit only for servers. For LAN users Internet access, you will bring in either DSL or Cable Internet. In addition, you like to have incoming IPSec VPN traffic into the LAN to go over the DSL or Cable Internet and not the T1/E1 circuit.
Following is the list of possible scenarios of network design.
1. Deploying one PIX 515 or ASA 5510 with DMZ
T1/E1 DSL/Cable Internet
| |
Existing T1/E1 router | Outside
| DMZ |
Switch -------------------- PIX 515 or ASA 5510
| |
Servers | Inside
|
LAN
2. Deploying two 1841 routers
T1/E1 DSL/Cable Internet
| |
Existing T1/E1 router |
| | Outside
First 1841 router |
| DMZ |
Switch ----------------- Second 1841 router
| |
Servers | Inside
|
LAN
3. Deploying one 871 router, one ASA 5505, and one Catalyst 3560 Layer-3 switch
T1/E1 DSL/Cable Internet
| |
Existing T1/E1 router | Outside
| |
871 router ASA 5505
| DMZ |
Switch ----------- Catalyst 3560 Layer-3 switch
| |
Servers | Inside
|
LAN
General Ideas and Considerations
For the illustration sake, let's consider the 1st scenario which employs the ASA 5510 with DMZ feature.
* The servers have default gateway pointing to the T1/E1 router
* The T1/E1 router has default gateway pointing to the T1/E1 ISP just like current setup
* There is a route at T1/E1 router pointing to the ASA DMZ interface to reach the LAN
* The ASA default gateway points to the the DSL/Cable Internet ISP
* There is a route at the ASA pointing to the T1/E1 router to reach the servers
* Incoming IPSec VPN traffic to the LAN go through the DSL/Cable Internet and terminates at ASA. In other words, the ASA acts as both Internet firewall and VPN Concentrator
* The servers' IP address can be either Public or Private IP addresses
* The LAN IP addresses are Private IP addresses
* No NAT in place for communication between the servers and the LAN
* There may be NAT in place for communication between the servers and the Internet, depending on network requirements
* There is no NAT in place for communication between the LAN and the incoming VPN traffic
* There is NAT in place for communication between the LAN and the Internet
The network design general ideas of all three above scenarios are pretty much similar. The first scenario is considered the simplest solution. You just have to make sure whoever manage the existing T1/E1 router is able to do any adjustment (i.e. adding route pointing to the ASA DMZ interface to reach LAN) due to the network design change. If for any reason the T1/E1 router management is unable or is unwilling to do any adjustment, then either second or third scenario should be feasible as well.
Note that in the first scenario, the ASA 5510 acts as both Internet firewall and VPN Concentrator. In the second scenario, the Second 1841 router acts as Internet firewall, Internet router, and VPN Concentrator. In the third scenario, the ASA 5505 acts as both Internet firewall and VPN Concentrator where the 3560 Layer-3 switch deals with routing between LAN, servers (DMZ), and the Internet.
Between Private and Public IP address Assignment for the servers
You have a choice of either assigning Public IP address directly to the servers, or assigning Private IP address to the servers. When the servers are assigned Private IP address, then the T1/E1 router does NAT for the servers when the servers need to communicate with the Internet. When the servers are assigned Public IP address directly, then no NAT should occur at the T1/E1 router for the servers when the servers need to communicate with the Internet.
There are times when assigning Public IP address directly to the servers are preferable. When there is a plan to have DNS A record for those servers for example, you may want the servers to have Public IP address assigned to them directly. This way you don't have to create DNS BIND for both the NAT-ed Public IP address and the Private IP address. You only need to create the BIND for just the Public IP address to serve both the Internet users and LAN users. When there is no need to have such DNS A record, then assigning Private IP address to the servers might be acceptable.
For more info, you can check out the following FAQ
»Cisco Forum FAQ »NAT, PAT, Internet and Server Access: Introduction and Best Practice
Sample Configuration
Following sample configuration reflects the network design first scenario.
Assumptions
* The servers are assigned Public IP address of 1.1.1.0/29 directly.
* There are two servers in place, one is web (supporting both HTTP and HTTPS/SSL) and another is mail
* Web server IP address is 1.1.1.3 and Mail server IP address is 1.1.1.4
* Default gateway of all servers is the 1.1.1.1 (T1/E1 router)
* No NAT in place at T1/E1 router for communication between the servers and the Internet
* LAN (Inside) is still be able to access the servers via the DMZ connection without problem
* Only the LAN can initiate connection to servers or anything within 1.1.1.0/29
* Servers or anything within 1.1.1.0/29 cannot initiate connection to LAN due to security concern
* In terms of LAN-DMZ communication, anything within 1.1.1.0/29 (including the servers) can only response to communication initiated from LAN
* In terms of DMZ-Internet communication, either the servers or the Internet can initiate communication to the other
* The existing T1/E1 router deploys CBAC to create Internet firewall. For more info, check out the following FAQ
»Cisco Forum FAQ »Sample IOS Firewall (CBAC) router configuration
»Cisco Forum FAQ »Sample Configuration of ACL-CBAC-IDS/IPS-IPSec VPN on router
* The ASA uses Microsoft Active Directory Domain Controller to authenticate incoming VPN connection to LAN machines. For more info, check out the following FAQ
»Cisco Forum FAQ »Configure PIX/ASA as both Internet Firewall and VPN Concentrator
Notes
* The above assumptions are considered typical network policy, practice, and deployment in a lot of organizations. You can always make adjustments to suit your specific requirements when needed.
* The router CBAC configuration can be simply replaced by more advanced Zone-Based Firewall configuration. Check out the following FAQ for more info
»Cisco Forum FAQ »Zone-Based Firewall Sample Configuration
Scenario 1
Existing T1/E1 router (i.e. 1721, 2620, similar or higher)
ASA 5510
VRF-lite Approach
The situation is similar with this approach. There is still a T1/E1 circuit you need to dedicate only for public server access and there is a separate DSL/Cable/Wireless connection for LAN. Following is the network design.
T1/E1 circuit DSL/Cable/Wireless
| |
| |
Existing T1/E1 and DSL/Cable/Wireless
router
*
* Trunk to Switch
*
Switch
General Ideas and Considerations
* Each of the T1/E1 circuit and DSL/Cable/Wireless connection connects to different network or even different ISP
* There are two networks that the router manages, which are the Public server network and LAN
* The Public server network only uses the T1/E1 circuit to connect to the Internet. The Public server network can never use the DSL/Cable/Wireless connection to access the Internet.
* The LAN only uses the DSL/Cable/Wireless connection to browse the Internet. The LAN can never use the T1/E1 circuit to access the Internet.
* The LAN users must go through the Internet to access the Public server network. There is no direct connection internally within the router to connect the LAN and the Public server network.
* Both of Public server network and LAN uses Private subnet internally
* The router acts as NAT/PAT device for Private-Public IP Subnet translation
* The router run Zone-Based Firewall for security
* There are three public-accessible servers within the Public server network which are FTP, Mail, and Web
* Zone-Based Firewall inspects all outbound traffic (from Public server network or from LAN to the Internet) and their returning traffic
* Zone-Based Firewall also inspect all inbound traffic (from the Internet to the Public server network)
VRF-aware Zone-Based Firewall Sample Configuration
1. Router (i.e. 1841, 2621XM, etc.)
2. Switch (i.e. Catalyst 2950, 2960, etc.)
feedback form
feedback form
by aryoba
last modified: 2009-02-26 12:12:30 |
|
