Deploying video servers in the DMZ region
I. BACKGROUND
Division I will be on the shelves of a number of video servers, through this server to manage the national organization's video surveillance cameras, the server needs to be deployed in the head office, to facilitate the operation of the company's IT operations, but to enable the organization's video surveillance cameras through the local network to each other access, through the network planning , you need to create a new DMZ area on the firewall to deploy the video server to meet the traffic access needs of your business.
Second, network topology
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/6F/43/wKiom1WWBd7BwCiKAAKEBsqzTsE303.jpg "title=" Small Micro Finance Division external network release. jpg "width=" 747 "height=" 495 "border=" 0 "hspace=" 0 "vspace=" 0 "style=" width:747px;height:495px; "alt=" Wkiom1wwbd7bwcikaakebsqztse303.jpg "/>
Third, network configuration
1. Create a new DMZ area on the firewall, and configure the sub-interface to enable the gateway on the firewall, associate the vlan367; Xia Lian an access switch, connect the video server via the switch, build VLAN 367 on the switch, set the port connected to the server to access mode, and belongs to the vlan367, the switch upper port is set to trunk port, on the core switch, the static route to the video server segment is fully sent into OSPF, so that the intranet can be managed to the video server.
2, the specific configuration is as follows:
(1) on the core switch:
Set routing-options static route 106.39.2.xx/28 Next-hop 10.63.xx.xx
Set policy-options policy-statement To-shipin-server term ten from protocol static
Set policy-options policy-statement to-shipin-server term ten from Route-filter 106.39.2.XX/28 exact
Set policy-options policy-statement to-shipin-server term ten then accept
Set protocols OSPF export TO-SHIPIN-SERVER//Publish to OSPF
(2) on the fire wall:
Set interface "ETHERNET0/1" zone "DMZ"
Set interface "ethernet0/1.367" tag 367 zone "DMZ"
Set interface ethernet0/1.367 IP xx.xx.67.169/29
Set interface ethernet0/1.367 NAT
Set interface ETHERNET0/1 IP manageable
Set address "DMZ" "Xx.xx.67.168/29" xx.xx.67.168 255.255.255.248
Set interface "ETHERNET0/3" MIP 106.39.2.xx host xx.xx.67.170 netmask 255.255.255.255 VR "TRUST-VR"
Set policy ID 1 from ' Trust ' to ' untrust ' "X.XX.XX.0/8" "any" "any" permit log
Set Policy ID 1
Exit
Set policy ID 2 from ' Trust ' to ' DMZ ' "Any '" "Xx.xx.67.168/29" "any" permit log
Set Policy ID 2
Exit
Set policy ID 3 from ' DMZ ' to ' untrust ' "Xx.xx.67.168/29" "any" "any" permit log
Set Policy ID 3
Exit
Set policy ID 6 from ' untrust ' to ' DMZ ' ' Any ' ' MIP (106.39.2.xx) ' "any" permit
Set Policy ID 6
Exit
(3) on the access switch:
Conf
VLAN 367
Exit
Interface Range F0/1-10
Switch mode access
Switch Access VLAN 367
Interface G0/25
Switch mode trunk
Description "TO-XXXX.XXX.ETH0/1"
Iv. Business Testing
1, the intranet can remotely manage the video server.
2, the intranet can access the Internet normally.
3, the video server can not actively access the intranet.
4, the video server can access the Internet normally.
5, the organization can access the video server through the mapped public network address (106.39.2.X) normally.
This article from "Liu Fei Blog Space" blog, declined reprint!
Deploying video servers in the DMZ area