Cisco Blog
7/29/2015
Uverse and the DMZ Continued
In this configuration there is no way to put this network into a DMZ zone off the firewall because you cannot subnet the block of IP addresses AT%T gives you and the DMZ zone needs to be on a seperate subnet than the outside zone
To solve this, it is possible to add additional firewall in transparent mode.
In my setup I am using the zone based firewall feature on a Cisco 2811 as my main firewall and a Cisco 3745 as a DMZ zone based firewall. I set up the main firewall with 3 interfaces. The first interface is pointing to the AT&T residential gateway which is an NGV589. I have configured it in passthrough mode. The second interface is pointing to the internal private network and the third interface is pointing to the DMZ.
Since I have only one block of IP space I have configured an IRB bridge between the AT&T interface and the DMZ. I have configured a public IP address on the BVI interface. The NAT and firewall outside zones are configred here. The inside interface is configured on the private interface connected to my internal network.
Now I have a layer 2 network from the outside interface to the DMZ interface and and IP address on it that will be used as my outside zone on the firewall.
The other firewall is setup with three interfaces as well. Two of the interfaces are configured on a CRB bridge. I don't want any IP routing on these interfaces. The third interface is configured with a private IP address for management. The firewall zones are configured on the bridged interfaces. The firewall configuration is exactly the same as any other interface.
The next item was to setup the hosts in the DNS server to point to the public io addresses. This is nothing more than adding the A records to point to the servers. This takes NAT and port forwarding out of the equation.
Back to home