Suggested Prerequisite Reading
»Cisco Forum FAQ »NAT, PAT, Port Forward, Internet and Server Access: Introduction and Practices
Traditional Approach
Currently you have T1/E1 circuit for Internet access of both LAN users and servers. Due to bandwidth consumption, you decide to dedicate the T1/E1 circuit only for servers. For LAN users Internet access, you will bring in either DSL or Cable Internet. In addition, you like to have incoming IPSec VPN traffic into the LAN to go over the DSL or Cable Internet and not the T1/E1 circuit.
Following is the list of possible scenarios of network design.
1. Deploying one PIX 515 or ASA 5510 with DMZ
T1/E1 DSL/Cable Internet
| |
Existing T1/E1 router | Outside
| DMZ |
Switch -------------------- PIX 515 or ASA 5510
| |
Servers | Inside
|
LAN
2. Deploying two 1841 routers
T1/E1 DSL/Cable Internet
| |
Existing T1/E1 router |
| | Outside
First 1841 router |
| DMZ |
Switch ----------------- Second 1841 router
| |
Servers | Inside
|
LAN
3. Deploying one 871 router, one ASA 5505, and one Catalyst 3560 Layer-3 switch
T1/E1 DSL/Cable Internet
| |
Existing T1/E1 router | Outside
| |
871 router ASA 5505
| DMZ |
Switch ----------- Catalyst 3560 Layer-3 switch
| |
Servers | Inside
|
LAN
General Ideas and Considerations
For the illustration sake, let's consider the 1st scenario which employs the ASA 5510 with DMZ feature.
* The servers have default gateway pointing to the T1/E1 router
* The T1/E1 router has default gateway pointing to the T1/E1 ISP just like current setup
* There is a route at T1/E1 router pointing to the ASA DMZ interface to reach the LAN
* The ASA default gateway points to the the DSL/Cable Internet ISP
* There is a route at the ASA pointing to the T1/E1 router to reach the servers
* Incoming IPSec VPN traffic to the LAN go through the DSL/Cable Internet and terminates at ASA. In other words, the ASA acts as both Internet firewall and VPN Concentrator
* The servers' IP address can be either Public or Private IP addresses
* The LAN IP addresses are Private IP addresses
* No NAT in place for communication between the servers and the LAN
* There may be NAT in place for communication between the servers and the Internet, depending on network requirements
* There is no NAT in place for communication between the LAN and the incoming VPN traffic
* There is NAT in place for communication between the LAN and the Internet
The network design general ideas of all three above scenarios are pretty much similar. The first scenario is considered the simplest solution. You just have to make sure whoever manage the existing T1/E1 router is able to do any adjustment (i.e. adding route pointing to the ASA DMZ interface to reach LAN) due to the network design change. If for any reason the T1/E1 router management is unable or is unwilling to do any adjustment, then either second or third scenario should be feasible as well.
Note that in the first scenario, the ASA 5510 acts as both Internet firewall and VPN Concentrator. In the second scenario, the Second 1841 router acts as Internet firewall, Internet router, and VPN Concentrator. In the third scenario, the ASA 5505 acts as both Internet firewall and VPN Concentrator where the 3560 Layer-3 switch deals with routing between LAN, servers (DMZ), and the Internet.
Between Private and Public IP address Assignment for the servers
You have a choice of either assigning Public IP address directly to the servers, or assigning Private IP address to the servers. When the servers are assigned Private IP address, then the T1/E1 router does NAT for the servers when the servers need to communicate with the Internet. When the servers are assigned Public IP address directly, then no NAT should occur at the T1/E1 router for the servers when the servers need to communicate with the Internet.
There are times when assigning Public IP address directly to the servers are preferable. When there is a plan to have DNS A record for those servers for example, you may want the servers to have Public IP address assigned to them directly. This way you don't have to create DNS BIND for both the NAT-ed Public IP address and the Private IP address. You only need to create the BIND for just the Public IP address to serve both the Internet users and LAN users. When there is no need to have such DNS A record, then assigning Private IP address to the servers might be acceptable.
For more info, you can check out the following FAQ
»Cisco Forum FAQ »NAT, PAT, Port Forward, Internet and Server Access: Introduction and Practices
Sample Configuration
Following sample configuration reflects the network design first scenario.
Assumptions
* The servers are assigned Public IP address of 1.1.1.0/29 directly.
* There are two servers in place, one is web (supporting both HTTP and HTTPS/SSL) and another is mail
* Web server IP address is 1.1.1.3 and Mail server IP address is 1.1.1.4
* Default gateway of all servers is the 1.1.1.1 (T1/E1 router)
* No NAT in place at T1/E1 router for communication between the servers and the Internet
* LAN (Inside) is still be able to access the servers via the DMZ connection without problem
* Only the LAN can initiate connection to servers or anything within 1.1.1.0/29
* Servers or anything within 1.1.1.0/29 cannot initiate connection to LAN due to security concern
* In terms of LAN-DMZ communication, anything within 1.1.1.0/29 (including the servers) can only response to communication initiated from LAN
* In terms of DMZ-Internet communication, either the servers or the Internet can initiate communication to the other
* The existing T1/E1 router deploys CBAC to create Internet firewall. For more info, check out the following FAQ
»Cisco Forum FAQ »Sample IOS Firewall (CBAC) router configuration
»Cisco Forum FAQ »Sample Configuration of ACL-CBAC-IDS/IPS-IPSec VPN on router
* The ASA uses Microsoft Active Directory Domain Controller to authenticate incoming VPN connection to LAN machines. For more info, check out the following FAQ
»Cisco Forum FAQ »Configure PIX/ASA as both Internet Firewall and VPN Concentrator
Notes
* The above assumptions are considered typical network policy, practice, and deployment in a lot of organizations. You can always make adjustments to suit your specific requirements when needed.
* The router CBAC configuration can be simply replaced by more advanced Zone-Based Firewall configuration. Check out the following FAQ for more info
»Cisco Forum FAQ »Zone-Based Firewall Sample Configuration
Scenario 1
Existing T1/E1 router (i.e. 1721, 2620, similar or higher)
ASA 5510
VRF-lite Approach
The situation is similar with this approach. There is still a T1/E1 circuit you need to dedicate only for public server access and there is a separate DSL/Cable/Wireless connection for LAN. Following is the network design.
T1/E1 circuit DSL/Cable/Wireless
| |
| |
Existing T1/E1 and DSL/Cable/Wireless
router
*
* Trunk to Switch
*
Switch
General Ideas and Considerations
* Each of the T1/E1 circuit and DSL/Cable/Wireless connection connects to different network or even different ISP
* There are two networks that the router manages, which are the Public server network and LAN
* The Public server network only uses the T1/E1 circuit to connect to the Internet. The Public server network can never use the DSL/Cable/Wireless connection to access the Internet.
* The LAN only uses the DSL/Cable/Wireless connection to browse the Internet. The LAN can never use the T1/E1 circuit to access the Internet.
* The LAN users must go through the Internet to access the Public server network. There is no direct connection internally within the router to connect the LAN and the Public server network.
* Both of Public server network and LAN uses Private subnet internally
* The router acts as NAT/PAT device for Private-Public IP Subnet translation
* The router run Zone-Based Firewall for security
* There are three public-accessible servers within the Public server network which are FTP, Mail, and Web
* Zone-Based Firewall inspects all outbound traffic (from Public server network or from LAN to the Internet) and their returning traffic
* Zone-Based Firewall also inspect all inbound traffic (from the Internet to the Public server network)
VRF-aware Zone-Based Firewall Sample Configuration
1. Router (i.e. 1841, 2621XM, etc.)
2. Switch (i.e. Catalyst 2950, 2960, etc.)
 feedback form
 feedback form
by aryoba 
last modified: 2009-02-26 12:12:30 |
