Once network zones are established and assigned to interfaces, you will start with creating firewall rules called access control lists, or ACLs. Step 3: Configure access control lists (It’s your party, invite who you want.) As you build out your network infrastructure, switches that support virtual LANs (VLANs) should be used to maintain level-2 separation between the networks. Network address translation (NAT) must be configured to allow internal devices to communicate on the internet when necessary.Īfter you have designed your network zone structure and established the corresponding IP address scheme, you are ready to create your firewall zones and assign them to your firewall interfaces or sub-interfaces. If you are using IP version 4, internal IP addresses should be used for all your internal networks. These zones usually include database servers, workstations, and any point of sale (POS) or voice over internet protocol (VoIP) devices.

Alternatively, servers that are not accessed directly from the internet should be placed in internal server zones. email, VPN) should be organized into a dedicated zone that limits inbound traffic from the internet-often called a demilitarized zone, or DMZ.

Easy for you is easy for attackers!Īll your servers that provide web-based services (ie.g. Don’t take the easy way out and make it all one flat network. Plan out a structure where assets are grouped based on business and application need similar sensitivity level and function, and combined into networks (or zones). To best protect your network’s assets, you should first identify them. Step 2: Architect firewall zones and IP addresses (No heavy lifting required.)

Cisco firewall