Configuration Requirements - Cisco 5510 - ASA SSL / IPsec VPN Edition Getting Started Manual

Chapter 8 Scenario: DMZ Configuration

Configuration Requirements

So That...
Internal clients can
request information from
web servers on the
Internet
Internal clients can
request information from
the DMZ web server
External clients can
request information from
the DMZ web server
78-19186-01
Enabling Inside Clients to Communicate with Devices on the Internet,
•
page 8-10
Enabling Inside Clients to Communicate with the DMZ Web Server,
•
page 8-10
Configuring Static PAT for Public Access to the DMZ Web Server (Port
•
Forwarding), page 8-17
Providing Public HTTP Access to the DMZ Web Server, page 8-20
•
The remainder of this chapter provides instructions for how to implement this
configuration.
This DMZ deployment of the adaptive security appliance requires configuration
rules as follows.
Create These Rules...
The adaptive security appliance comes with a default configuration that
permits inside clients access to devices on the Internet. No additional
configuration is required.
A NAT rule between the DMZ and inside interfaces that translates the
•
real IP address of the DMZ web server to its public IP address
(10.30.30.30 to 209.165.200.225).
• A NAT rule between the inside and DMZ interfaces that translates the
real addresses of the internal client network. In this scenario, the real
IP address of the internal network is "translated" to itself, that is, the
real IP address of the internal network is used when internal clients
communicate with the DMZ web server (10.30.30.30).
An address translation rule between the outside and DMZ interfaces
•
that translates the public IP address of the DMZ web server to its private
IP address (209.165.200.225 to 10.30.30.30).
An access control rule permitting incoming HTTP traffic that is
•
destined for the DMZ web server.
Configuring the Adaptive Security Appliance for a DMZ Deployment
Cisco ASA 5500 Series Getting Started Guide
8-9