Firewall on a stick DMZ policy rules

Question

I'm in the process of reconfiguring my 1800f v7.12 to a firewall on a stick topology. The new configuration will only have 2 active physical ports that connect to CORE1 and CORE2 switches. The CORE switches have a physical connection to the Edge router. I'm using BGP for the routing and that seems to be working.

Each active port have 2 sub interfaces, a trusted VLAN and an untrusted VLAN.

My issue is the trying to modify my current FW policies. The inside to outside seems to be working fine. However, I do need several policies that allow for my DMZ traffic to hit certain IPs on the inside. With only a trusted and untrusted ports to choose from I'm confused as to what that policy would look like. Technically, now my inside IPs and my DMZ IPs are considered inside addresses.

BTW, the CORE switches forward all my DMZ subnet to the FW. The gateway for the DMZ subnet is the FW. I have no static routes, its all BGP.

SUPE03 · Accepted Answer

Yes, I forgot to mention the gateway for the inside traffic is at the CORE switches so true inside traffic does not have to transverse the FW to communicate. The gateway for the DMZ IPs is at the FW. It never occurred to me to set up a policy rule from inside to inside. I will give that a shot. Many thanks!

ESCHAN_FTNT · Answer

Hi CAB3

If I understand correctly, DMZ is part of the trust VLAN and your inside IP is also located in trust VLAN? You are trying to route some packet from DMZ to inside IP? If yes, you could just setup firewall policy from trust VLAN to trust VLAN.
Technically, your CORE switches should be forwarding directly to the inside IP without sending to the FW, for optimum processing. However, if the packet do reach FW, then you could configure firewall policy from trust VLAN to trust VLAN so that FW will not drop the packet. Cheers.

Sign up

Login with SSO

Login to the community

Login with SSO