How can I setup DMZ network

Question

Hi,
I would like to setup DMZ in my network to access 5 servers from internet. We have total 6 public IP's from service provider. We have firewall ASA 5510 with 4 ports. 1 is used for  outisde interface with public IP, another 2 are set in redundant interface as inside interface and 1 port is free. i want to connect all the five servers to this port as my management does not want to get DMZ traffic in to inside network. firewall is setup in router mode. Can someone please help to configure this?
Regards
Mukesh Patel.

Answer 1

Interface GigabitEthernetx/x
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
no shut
The FW interface becomes the GW to your servers and you can assign static IPs to the Servers in the 172.16.1.0/24 range then you can install a L2 switch and create a shared L2 vlan between the FW DMZ interface and the Servers that needs to talk to the DMZ interface of the FW.
Then you can configure acls for DMZ and apply them to the DMZ interface.
access-group acl_dmz in interface dmz
Do not forget that to make the 172.16.1.0/24 servers reachable from outside, you need to create static NAT entries for each server. For example:
 static (dmz,outside) Server_Public_IP_1 172.16.1.2 netmask 255.255.255.255
static (dmz,outside) Server_Public_IP_2 172.16.1.3 netmask 255.255.255.255
static (dmz,outside) Server_Public_IP_3 172.16.1.4 netmask 255.255.255.255
static (dmz,outside) Server_Public_IP_4 172.16.1.5 netmask 255.255.255.255
static (dmz,outside) Server_Public_IP_5 172.16.1.6 netmask 255.255.255.255