Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We just ordered a sonicwall NSA 4500 firewall and I am preparing a network diagram for its arrival.

  • We have 12 servers in a newly setup rack, a 48-port switch, and a Sonicwall NSA 4500 firewall
  • I want 2 VLANs, a DMZ for public traffic and an internal network for which the firewall will provide NAT
  • The DMZ VLAN will connect to the firewall PORT 1
    • All servers in the DMZ VLAN have public internet-routable IPs (they’re webservers, each box has a 2nd NIC connected to the internal network to talk to the internal boxes, DB/Application servers)
  • The internal VLAN will connect to firewall PORT 2

My question is configuring the firewall with these VLANs.

I’d like to guarantee the bandwidth to the DMZ VLAN isn’t affected by what the internal VLAN will do (the internal VLAN has the potential to saturate its 1Gbit link at times, that shouldn’t affect the DMZ-user traffic).

So from the router can we have 2 ports configured:

  1. Firewall port 3 is configured with a public internet routable IP and provides the NAT translation to the internal VLAN on port 2 (these two ports are segregated off in their own VLAN on the firewall)
  2. Firewall port 4 has a separate connection to the upstream gateway, but in this case I’m confused about configuring port 4, should it have an IP in this case? I think not because the DMZ VLAN boxes all are configured with their own public IP, in this case the firewall is just forwarding the traffic correct?

Am I even correct in assuming that I can/should have 2 outbound links for each of the 2 VLANs (private and DMZ)?

I'd appreciate the help on this 2nd point of confusion, my primary expertise is in application architecture rather than network architecture.

share|improve this question
    
When you say port 4 has a seperate connection to the upstream gateway do you mean the same gateway as port 3? is it just two redundant links to the same ISP? –  GerryEgan Mar 18 '13 at 12:57
    
This is a point I'm a little confused about. Ultimately both the outbound links on the firewall are connecting to an upstream switch and will use the same gateway. I want to provide (1) some protection against saturating one of the 1Gbit lines (possible from the internal network). And I have the separate VLANS DMZ/Internal for security. –  davidparks21 Mar 19 '13 at 4:31
add comment

1 Answer

After finding some documentation on the firewall I'm pretty confident that the answer is that the DMZ network is configured as a "Transparent Mode or as Passthrough" on the firewall, the devices on that network won't know the firewall exists.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.