Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to find a firewall that will give me 1 LAN port, and 5-7 DMZ ports.

I have a requirement to replace some FreeBSD systems that are used to run some testing equipment. It is essential that the DMZ ports cannot communicate with each other, but the LAN port can communicate with everyone. That way a user on the LAN can connect to the test systems, but the test systems are isolated entirely and cannot interfere with each other.

One of the DMZ's will be connected to a VMWare ESXi server, one to a standard server, and the rest to various types of equipment.

The lan port will be connected to the corporate LAN switch.

Sorry if i am a little vague, I am just trying to work all this out myself! Currently we have a FreeBSD configured, but the quad port NIC's are pretty expensive, and the PC itself is old, so i would prefer to replace it with a dedicate piece of kit which can do the same job, but more reliably! These test rigs are used all over the place, and get moved quite often, so i am aiming for Cisco kit for ease of configuration and reliability of the hardware itself.


share|improve this question
Just so I'm 100% sure: You want 5-7 different DMZ zones? As in, 5-7 different subnets? – pauska Apr 21 '10 at 9:23
When I setup a "DMZ" I typically try to put each server or service in it's own subnet and make the firewall the default route for everything, rather than have every DMZ service in a single subnet. For instance, there is no reason why my FTP server should be able to ssh to my DNS server, or my web server send DNS traffic to my mail server. – chris Apr 26 '10 at 15:57

One of the Cisco 55xx series ASA hardware firewalls should be what you're after.

You should probably have a good look through their various specifications and choose the one that gives you the right feature set. (It's difficult for me to do this, not knowing your exact set up currently). Also choose one which will give you room to expand in the future.

If I had to guess, I'd say to choose the 5520 or 5540 models..

If you want High Availability, you'll need 2 of these, that support Active/Standby configuration. This is supported by models 5520 and above.

You might be able to save some money by having the DMZ ports on a VLAN which is then distributed by a managed switch. That way, you could trunk multiple DMZs traffic over a single port, with a virtual interface (You could do this on your FreeBSD box too, might save you having to have a quad port server NIC.) [YMMV on this bit though]

share|improve this answer
And this was also my suggestion, I just wanted to get confirmation about 5-7 different DMZ zones. +1 – pauska Apr 21 '10 at 9:33
We use Cisco Cat65's with ACEs - but that's probably overkill... – Chopper3 Apr 21 '10 at 13:37
+1 on ASA's ... although i would start looking at the 5510 (possibly with Security+ although with what he is describing it doesn't seem that is needed) especially if price is an issue. – Zypher Apr 21 '10 at 16:15
@Chopper: Showoff :) – Zypher Apr 21 '10 at 16:15
@Zypher, I know, I'm lucky - I get to fix problems with a chequebook, I love coming on here and seeing how smarter guys than me do the same using their brains :) – Chopper3 Apr 21 '10 at 18:03

I'll elaborate on what Kyle's describing:

You need a firewall that understands 802.1q vlan tagging. Ideally it will have at least one gigabit interface.

You need a switch that also speaks 802.1q vlan tagging.

Now -- configure each of your DMZs and associate each DMZ with a different 802.1q tag, lets say the tags are 10, 20, 30, and 40.

Now, add all those tags to one interface on the firewall (thus creating a "VLAN trunk") and run that "trunk" to a switch that also has those VLAN tags associated with that port.

Now, put several other interfaces untagged on each vlan and connect those untagged ports to the host computers.

Now your firewall has exclusive access to all the tags and can enforce ACLs that prevent one subnet from accessing any other DMZ subnet.

share|improve this answer
+1 Thanks chris :-) – Kyle Brandt Apr 21 '10 at 16:16
I think this is why some vendors don't support 802.1q tags on their firewalls. If I've got a firewall with a gig interface that supports 802.1q, I don't really need more than a port or two. So long as I never expose the trunk to a non-network device, I'm not really worried about tag hopping antics. – chris Apr 21 '10 at 16:41
off the top of their heads, does anyone know if BSD's ipfw support 802.1q tagging? if so, can you point me in the direction of a good how to? – BParker Apr 23 '10 at 8:02
I don't think it is IPFW per se that supports 802.1q tagging; it is that you create several virtual interfaces each with their own tag, and then create policies between these interfaces (and hence the vlans). the vlan man page and discuss this. – chris Apr 26 '10 at 4:35

Depending on your security needs, if you have a good modern switch you can make each dmz a vlan and just use one port, and then have the rules separating each dmz on the router.

There are arguments against this though, there used to be ways to bypass vlans (vlan hopping), but I think there is nothing current. Also, a misconfiguration of the switch could lead to a security hole.

share|improve this answer
I'n not too borthed about vlan hopping, since this is in a controlled environment. Can you give me any further detail on how to set this up the way you describe? – BParker Apr 23 '10 at 8:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.