Downloads |
Table Of Contents
Restrictions for Demilitarized Zone (DMZ) Port
Information About Demilitarized Zone (DMZ) Port
Configuration Examples for DMZ Port
Demilitarized Zone (DMZ) Port
The Demilitarized Zone (DMZ) port permits two LAN networks instead of the currently available single LAN network. This feature will enable switch port 4 of the existing four 10/100 switch ports to be optionally used as a Layer 3 LAN port, thereby providing Cisco 830 series routers with one more 10-Mbps Layer 3 LAN port. The new LAN port can be used for DMZ purposes for public access to the customer's web and other servers that are accessible from the Internet. The existing LAN network ports will continue to be used for private internal traffic.
Typically the DMZ port is configured at a lower security level than the other LAN ports on the Cisco 830 series router.
Feature History for Demilitarized Zone (DMZ) Port
12.3(7)XR1
This feature was introduced.
12.3(14)T
This feature was integrated into Cisco IOS Release 12.3(14)T.
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Restrictions for Demilitarized Zone (DMZ) Port
•
•
Restrictions for Demilitarized Zone (DMZ) Port
•
•
•
•
•
•
Information About Demilitarized Zone (DMZ) Port
To configure the Demilitarized Zone (DMZ) Port feature, you should understand the following concepts:
DMZ Networks
A DMZ network enables Internet users to access a company's public servers, including Web and File Transfer Protocol (FTP) servers, while maintaining security for the company's private LAN.
How to Enable DMZ Port
This section contains the following procedure:
Enabling DMZ Port
To enable the Ethernet 2 interface on your Cisco 830 series router for the DMZ Port feature, perform the following steps:
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Configuration Examples for DMZ Port
This section provides the following configuration example:
•
Configuring DMZ Port: Example
The following example shows the DMZ Port feature configured on a Cisco 831 router:
Building configuration...Current configuration : 3302 bytes!version 12.3no service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname!boot-start-markerboot-end-marker!memory-size iomem 5!no aaa new-modelip subnet-zero!!!!ip inspect audit-trail!interface Ethernet0ip address 192.168.27.1 255.255.255.0ip access-group 101 inip inspect standard inno cdp enable!interface Ethernet1ip address 172.16.2.1 255.255.0.0ip access-group 121 induplex autono cdp enable!interface Ethernet2 --------------> DMZ portip address 192.168.30.1 255.255.255.0ip access-group 111 in --------------> Applying access listip inspect standard out --------------> Applying inspect statementsno cdp enable!ip classless!ip http serverno ip http secure-server!!access-list 101 permit tcp 192.168.27.0 0.0.0.255 host 192.168.30.3 eq pop3access-list 101 permit tcp 192.168.27.0 0.0.0.255 host 192.168.30.3 eq telnetaccess-list 101 deny ip 192.168.27.0 0.0.0.255 192.168.30.0 0.0.0.255access-list 101 permit ip 192.168.27.0 0.0.0.255 anyaccess-list 101 deny ip any anyaccess-list 111 permit icmp 192.168.30.0 0.0.0.255 anyaccess-list 111 deny ip any anyaccess-list 121 permit tcp any host 192.168.30.3 eq wwwaccess-list 121 permit tcp any host 192.168.30.3 eq ftpaccess-list 121 permit tcp any host 192.168.30.3 eq smtpaccess-list 121 deny ip any anyendVerifying DMZ Port: Example
The following example shows the sample output from the show interface ethernet 2 privileged EXEC command used to verify if the Ethernet 2 port is enabled:
Router# show interfaces ethernet 2Ethernet2 is up, line protocol is upHardware is PQUICC_FEC, address is aaaa.0bbb.cccc (bia 000d.2813.53d2)Internet address is 10.0.0.1/8MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Full-duplex, 10Mb/sARP type: ARPA, ARP Timeout 04:00:00Last input 00:00:43, output never, output hang neverLast clearing of "show interface" counters neverInput queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0Queueing strategy: fifoOutput queue: 0/40 (size/max)5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec6965 packets input, 2250292 bytes, 0 no bufferReceived 6910 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected48474 packets output, 4881725 bytes, 0 underruns0 output errors, 0 collisions, 2 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outAdditional References
The following sections provide references related to DMZ port.
Related Documents
Cisco IOS Release 12.3 Configuration Guides and Command References
Cisco IOS Release 12.3 Configuration Guides and Command References
Standards
MIBs
•
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 command reference publications.
interface ethernet 2
To enable the DMZ Port feature, use the interface ethernet 2 command in interface configuration mode.
interface type number [name-tag]
Syntax Description
Defaults
Interface Ethernet 2 is disabled.
Command Modes
Interface configuration mode
Command History
Usage Guidelines
This command does not have a no form.
Examples
The following example shows how to enable the DMZ Port feature on Ethernet interface 2:
Router# interface ethernet 2Router# no shutdownshow interface ethernet 2
To display information about an Ethernet interface on the router, use the show interfaces ethernet command in privileged EXEC mode.
show interfaces ethernet [number] [accounting]
Syntax Description
number
(Optional) Port number on the selected interface.
accounting
(Optional) Displays the number of packets of each protocol type that have been sent through the interface.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
If you do not provide values for the number argument, the command displays statistics for all network interfaces. The optional keyword accounting displays the number of packets of each protocol type that have been sent through the interface.
Examples
The following is sample output from the show interface ethernet 2 command for Ethernet interface 2:
Router# show interfaces ethernet 2Ethernet2 is up, line protocol is upHardware is Lance, address is 0060.3ef1.702b (bia 0060.3ef1.702b)Internet address is 172.21.102.33/24MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255Encapsulation ARPA, loopback not set, keepalive set (10 sec)ARP type: ARPA, ARP Timeout 04:00:00Last input 00:00:20, output 00:00:06, output hang neverLast clearing of "show interface" counters neverQueueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec115331 packets input, 27282407 bytes, 0 no bufferReceived 93567 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 input packets with dribble condition detected143782 packets output, 14482169 bytes, 0 underruns0 output errors, 1 collisions, 5 interface resets0 babbles, 0 late collision, 7 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped out
Copyright © 2004, 2005 Cisco Systems, Inc. All rights reserved.
