Deploying video servers in the DMZ area

Deploying video servers in the DMZ region

I. BACKGROUND

Division I will be on the shelves of a number of video servers, through this server to manage the national organization's video surveillance cameras, the server needs to be deployed in the head office, to facilitate the operation of the company's IT operations, but to enable the organization's video surveillance cameras through the local network to each other access, through the network planning , you need to create a new DMZ area on the firewall to deploy the video server to meet the traffic access needs of your business.

Second, network topology

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/6F/43/wKiom1WWBd7BwCiKAAKEBsqzTsE303.jpg "title=" Small Micro Finance Division external network release. jpg "width=" 747 "height=" 495 "border=" 0 "hspace=" 0 "vspace=" 0 "style=" width:747px;height:495px; "alt=" Wkiom1wwbd7bwcikaakebsqztse303.jpg "/>

Third, network configuration

1. Create a new DMZ area on the firewall, and configure the sub-interface to enable the gateway on the firewall, associate the vlan367; Xia Lian an access switch, connect the video server via the switch, build VLAN 367 on the switch, set the port connected to the server to access mode, and belongs to the vlan367, the switch upper port is set to trunk port, on the core switch, the static route to the video server segment is fully sent into OSPF, so that the intranet can be managed to the video server.

2, the specific configuration is as follows:

(1) on the core switch:

Set routing-options static route 106.39.2.xx/28 Next-hop 10.63.xx.xx

Set policy-options policy-statement To-shipin-server term ten from protocol static

Set policy-options policy-statement to-shipin-server term ten from Route-filter 106.39.2.XX/28 exact

Set policy-options policy-statement to-shipin-server term ten then accept

Set protocols OSPF export TO-SHIPIN-SERVER//Publish to OSPF

(2) on the fire wall:

Set interface "ETHERNET0/1" zone "DMZ"

Set interface "ethernet0/1.367" tag 367 zone "DMZ"

Set interface ethernet0/1.367 IP xx.xx.67.169/29

Set interface ethernet0/1.367 NAT

Set interface ETHERNET0/1 IP manageable

Set address "DMZ" "Xx.xx.67.168/29" xx.xx.67.168 255.255.255.248

Set interface "ETHERNET0/3" MIP 106.39.2.xx host xx.xx.67.170 netmask 255.255.255.255 VR "TRUST-VR"

Set policy ID 1 from ' Trust ' to ' untrust ' "X.XX.XX.0/8" "any" "any" permit log

Set Policy ID 1

Exit

Set policy ID 2 from ' Trust ' to ' DMZ ' "Any '" "Xx.xx.67.168/29" "any" permit log

Set Policy ID 2

Exit

Set policy ID 3 from ' DMZ ' to ' untrust ' "Xx.xx.67.168/29" "any" "any" permit log

Set Policy ID 3

Exit

Set policy ID 6 from ' untrust ' to ' DMZ ' ' Any ' ' MIP (106.39.2.xx) ' "any" permit

Set Policy ID 6

Exit

(3) on the access switch:

Conf

VLAN 367

Exit

Interface Range F0/1-10

Switch mode access

Switch Access VLAN 367

Interface G0/25

Switch mode trunk

Description "TO-XXXX.XXX.ETH0/1"

Iv. Business Testing

1, the intranet can remotely manage the video server.

2, the intranet can access the Internet normally.

3, the video server can not actively access the intranet.

4, the video server can access the Internet normally.

5, the organization can access the video server through the mapped public network address (106.39.2.X) normally.

This article from "Liu Fei Blog Space" blog, declined reprint!

Deploying video servers in the DMZ area