ity, a DMZ is a network that is neither inside nor outside the firewall. The idea is that this third network can be accessed from inside, and probably outside the firewall, but security rules will prohibit devices in the DMZ The DMZ from connecting to devices on the inside. A DMZ is less secure than the inside network, but more secure than the outside network. A common DMZ scenario is shown in Figure 25-1. The Internet is located on the outside interface. The users are on the inside interface. Any servers that need to be accessible from the Internet are located in the DMZ network. Internet Web server Outside Email server Inside DNS server Users Figure 25-1. Simple DMZ network The firewall would be configured as follows: Inside network The inside network can initiate connections to any other network, but no other network can initiate connections to it. Outside network The outside network cannot initiate connections to the inside network. The outside network can initiate connections to the DMZ. The DMZ can initiate connections to the outside network, but not to the inside network. Any other network can initiate connections into the DMZ. One of the main benefits of this type of design is isolation. Should the email server come under attack and become compromised, the attacker will not have access to the users on the inside network. However, in this design, the attacker will have access to the other servers in the DMZ because they're on the same physical network. (The servers can be further isolated with Cisco Ethernet switch features such as private VLANs, port ACLs, and VLAN maps. See Chapter 23 for more information.) Chapter 25: Firewall Theory Servers in a DMZ should be locked down with security measures as if they were on the Internet. Rules on the firewall should be configured to allow services only as needed to the DMZ. For example: Email server POP, IMAP, and SMTP (TCP ports 110, 143, and 25) should be allowed. All other ports should not be permitted from the Internet. Web server HTTP and HTTPS (TCP ports 80 