zNetLaB › Guided labs › Enterprise
Zone-based firewall — inside, outside and a DMZ
Enterprise Advanced 4 devices 5 checked tasks 100 points Plan lab
Put the LAN, the internet link and the DMZ server into security zones, then let the inside browse out and the outside reach only the web server. Everything else stays denied — including, at first, the traffic you did not expect to break. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
Put the LAN, the internet link and the DMZ server into security zones, then let the inside browse out and the outside reach only the web server. Everything else stays denied — including, at first, the traffic you did not expect to break.
Your role: a network engineer on the enterprise team. Level: Advanced Done when: all 5 goals show as passed (100 points).
Network status
Devices: 1 PC, 1 router, 2 servers, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. Inside-PC is a host with 10.1.1.10/24, gateway 10.1.1.1. Edge starts with addresses (G0/0/0 10.1.1.1/24, G0/0/1 172.16.1.1/24, G0/0/2 203.0.113.1/24). DMZ-Web is a host with 172.16.1.10/24, gateway 172.16.1.1. Internet-Host is a host with 203.0.113.50/24, gateway 203.0.113.1. Known problems
None: nothing is misconfigured. The network is simply not finished: what the goals list is what you have to build or secure. Goals
Three zones exist and every interface is in one of them (20 pts) The inside can reach the internet host (25 pts) The inside can reach the DMZ web server (20 pts) The internet host can reach the DMZ server (20 pts) But the internet host still cannot reach the inside (15 pts) The activity, in order
Three zones exist and every interface is in one of them Why: Each goal is a state the lab can check on the running device. Verify with: show running-config The inside can reach the internet host Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 203.0.113.50 The inside can reach the DMZ web server Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 172.16.1.10 The internet host can reach the DMZ server Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 172.16.1.10 But the internet host still cannot reach the inside Why: Blocking traffic is half of security. You prove a block by showing the same ping that worked before now fails. Verify with: ping 10.1.1.10 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Why this matters
Put the LAN, the internet link and the DMZ server into security zones, then let the inside browse out and the outside reach only the web server. Everything else stays denied — including, at first, the traffic you did not expect to break.
What you will be able to do
Three zones exist and every interface is in one of them
The inside can reach the internet host
The inside can reach the DMZ web server
The internet host can reach the DMZ server
The network
PC, ISR 4331, Server — 4 devices in all, already cabled.
Fa0 Gi0/0/0 10.1.1.1/24 Fa0 Gi0/0/1 172.16.1.1/24 Fa0 Gi0/0/2 203.0.113.1/24 Inside-PC 10.1.1.10/24 · gw 10.1.1.1 Edge DMZ-Web 172.16.1.10/24 · gw 172.16.1.1 Internet-Host 203.0.113.50/24 · gw 203.0.113.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
Inside-PC PC 10.1.1.10 / 255.255.255.0 gw 10.1.1.1 Edge ISR 4331 configure it DMZ-Web Server 172.16.1.10 / 255.255.255.0 gw 172.16.1.1 Internet-Host Server 203.0.113.50 / 255.255.255.0 gw 203.0.113.1
Cabling
Inside-PC Fa0 ↔ Edge Gi0/0/0 DMZ-Web Fa0 ↔ Edge Gi0/0/1 Internet-Host Fa0 ↔ Edge Gi0/0/2
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
Edge interface g0/0/0
ip address 10.1.1.1 255.255.255.0
no shutdown
exit
interface g0/0/1
ip address 172.16.1.1 255.255.255.0
no shutdown
exit
interface g0/0/2
ip address 203.0.113.1 255.255.255.0
no shutdown Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 Three zones exist and every interface is in one of them 20 Checked automatically against the device’s live state (zonesSet). 2 The inside can reach the internet host 25 On Inside-PC: ping 203.0.113.50 must succeed. 3 The inside can reach the DMZ web server 20 On Inside-PC: ping 172.16.1.10 must succeed. 4 The internet host can reach the DMZ server 20 On Internet-Host: ping 172.16.1.10 must succeed. 5 But the internet host still cannot reach the inside 15 On Internet-Host: ping 10.1.1.10 must fail — the policy blocks it.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
Edge zone security INSIDE
exit
zone security OUTSIDE
exit
zone security DMZ
exit
class-map type inspect match-any ANY-TRAFFIC
match protocol icmp
match protocol tcp
match protocol udp
exit
policy-map type inspect PASS-ALL
class type inspect ANY-TRAFFIC
inspect
exit
exit
interface g0/0/0
zone-member security INSIDE
exit
interface g0/0/1
zone-member security DMZ
exit
interface g0/0/2
zone-member security OUTSIDE
exit
zone-pair security IN-OUT source INSIDE destination OUTSIDE
service-policy type inspect PASS-ALL
exit
zone-pair security IN-DMZ source INSIDE destination DMZ
service-policy type inspect PASS-ALL
exit
zone-pair security OUT-DMZ source OUTSIDE destination DMZ
service-policy type inspect PASS-ALL Where this is examined
This lab practises these topics in the zNetLaB certification courses:
ACLs, ZBFW, 802.1X, MACsec, wireless security — CCNP Enterprise · ENCOR · Security CoPP, uRPF, IPv6 FHS, 802.1X, ZBFW — CCIE Enterprise Infrastructure · Infrastructure Security and Services Network segmentation, DMZ and firewalls — CompTIA Security+ · Security Architecture Firewalls: ACLs, zone-based policy, NGFW concepts — CCNP Security Core · Network Security Firewalls, DMZ design and filtering — Ethical Hacking (network level) · Perimeter, Evasion and Secure Design
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.