I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private network and machines on the private network need access to machines in the DMZ.
I have read that the most secure implementation is one with two firewalls. The two firewalls that I am planning on using are both CISCO ASA 5500.
Although I am interested in how I can implement this with those specific devices, I am also interested in the theoretical side because I am creating documentation for customers of our company on how to set this up. Instructions specific to the devices I'm using help, but I also want to know how to solve this generically.
I have three specific machines:
As their names describe, DMZ_Web and DMZ_Service are in the DMZ and INT_SRV is the internal server.
I also have two firewalls:
- Ext Clients need access to DMZ_Web on port 443
- Ext Clients need access to DMZ_Service on port 3030
- DMZ_Web needs access to INT_SRV on port 2020
- In Clients need access to DMZ_Service on port 3030
- FW1 is connected to the internet, the DMZ, and the internal network
- FW2 is connected to the DMZ network (outside interface), and the internal network (inside interface)
- Internal Network is 192.168.1.0 255.255.0.0
- DMZ Network is 220.127.116.11 255.255.0.0
- DMZ machines have two NICs, one connected to FW1 and one connected to FW2. The NICs connected to FW2 have static IPs in the 18.104.22.168 range. The NICs connected to FW1 have static IPs that are publicly accessible from the internet.
Linked below is a diagram that I hope will answer a lot of questions concerning topology.
I've gathered that I may need to setup some static NAT rules to get traffic from the DMZ machines to the internal network and vice versa, but I'm not sure.
One thing I would like to point out is that the internal network is connected to FW1 & FW2. It is connected to FW1 to allow access to internet. It is connected to FW2 so that it can have access to devices in DMZ.
I'm not sure if this is correct. If it is not correct, what is the correct implementation? Also if it isn't correct, will it work?
I've searched all over but couldn't find a place that implemented my whole solution. Most of the time it was a piece here and there. I haven't been able to get all of the pieces to work together :(