8-9
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Chapter 8 Scenario: DMZ Configuration
Configuring the Adaptive Security Appliance for a DMZ Deployment
•
Enabling Inside Clients to Communicate with Devices on the Internet,
page 8-10
•
Enabling Inside Clients to Communicate with the DMZ Web Server,
page 8-10
•
Configuring Static PAT for Public Access to the DMZ Web Server (Port
Forwarding), page 8-17
•
Providing Public HTTP Access to the DMZ Web Server, page 8-20
The remainder of this chapter provides instructions for how to implement this
configuration.
Configuration Requirements
This DMZ deployment of the adaptive security appliance requires configuration
rules as follows.
So That...
Create These Rules...
Internal clients can
request information from
web servers on the
Internet
The adaptive security appliance comes with a default configuration that
permits inside clients access to devices on the Internet. No additional
configuration is required.
Internal clients can
request information from
the DMZ web server
•
A NAT rule between the DMZ and inside interfaces that translates the
real IP address of the DMZ web server to its public IP address
(10.30.30.30 to 209.165.200.225).
•
A NAT rule between the inside and DMZ interfaces that translates the
real addresses of the internal client network. In this scenario, the real
IP address of the internal network is “translated” to itself, that is, the
real IP address of the internal network is used when internal clients
communicate with the DMZ web server (10.30.30.30).
External clients can
request information from
the DMZ web server
•
An address translation rule between the outside and DMZ interfaces
that translates the public IP address of the DMZ web server to its private
IP address (209.165.200.225 to 10.30.30.30).
•
An access control rule permitting incoming HTTP traffic that is
destined for the DMZ web server.
