Isolate a DMZ from the LAN with NAT or ACL ?

[polm]

I have a DMZ subnet on one interface, and a LAN subnet on another.

I need to limit all traffic from the DMZ --> LAN to 'established' traffic only.

Would it be best to PAT an IP in the DMZ subnet for the LAN clients to use, and then throw some protective ACL's blocking DMZ --> LAN.

or...

Allow the LAN clients to route onto the DMZ subnet, and use ACL's, only, to limit the DMZ ---> LAN traffic?

 

[spidey07]

sounds like you need a pix.

But I would do it with ACLs and use the established tag.

 

[polm]

Originally posted by: spidey07
sounds like you need a pix.

But I would do it with ACLs and use the established tag.

I am using a PIX, and I did, indeed, decide to use ACL's only.

My config was questioned by a teammate, and I was trying to find some info about the NAT alternative.

It seemed to boil down to which process was more CPU demanding. I'm still not sure what the answer to that is.

 

[spidey07]

well if its a lower security interface it will block everything anyway. Adding NAT or ACLs would add processor.

but in reality if you are concerned with processor utilization on a pix then the pix isn't big enough.

-edit- the only time I've seen a pix peg out the processor was with a 50,000 line ACL or massive worm activity.

 

[polm]

Originally posted by: spidey07
well if its a lower security interface it will block everything anyway. Adding NAT or ACLs would add processor.

but in reality if you are concerned with processor utilization on a pix then the pix isn't big enough.

-edit- the only time I've seen a pix peg out the processor was with a 50,000 line ACL or massive worm activity.

not concerned about CPU, considering this is a really small setup. I just figured with multiple solutions, I should have some reasoning behind the choice I made.

 

[polm]

My bad...it's not a PIX. Just a 1700 series running 12.4.

 

[spidey07]

oh, then you will have to worry about processor if the load gets up. I hope this isn't routing LAN interfaces.

 

[polm]

Originally posted by: spidey07
oh, then you will have to worry about processor if the load gets up. I hope this isn't routing LAN interfaces.

Single router supporting 1 LAN, 1 DMZ, and 1 WAN interface,

 

[spidey07]

Originally posted by: polm

Originally posted by: spidey07
oh, then you will have to worry about processor if the load gets up. I hope this isn't routing LAN interfaces.

Single router supporting 1 LAN, 1 DMZ, and 1 WAN interface,

keep an eye on the processor. My guess is anything over 4-5 Mbs of traffic will bring it to its knees.