| 10.2 |  | Using ACLs |
| 10.2.3 |  | Two common uses of access lists |

| This example will look at two other common uses of access lists. Permitting partner Web access to the DMZ In the first example, a company uses access lists to allow its partners Web access to its DMZ. In the modern business environment, it is common for companies to create strategic alliances with one another in order to more effectively compete in the marketplace. As a result, it is often necessary for these companies to share resources. This is often done by placing these resources on the DMZ and allowing partners to access them via the Web.

In Figure , the ACL called acl_partner is applied to traffic inbound to the Partnernet interface. The ACL acl_partner permits Web connections from the hosts on network 172.18.0.0/28 to the DMZ Web server via its statically mapped address, 172.18.0.17. All other traffic from the Partnernet is denied.

Permitting DMZ access to internal mail
The second example, illustrated in Figure , shows hosts accessing internal mail from the DMZ. This is important because it is often desirable to allow outside hosts, on the DMZ or other outside networks, to access e-mail services on the inside network. This needs to be done without compromising the security of the inside network. Conceptually, the solution to this is the same as the solution to allowing partners to have Web access to the DMZ. A hole in the firewall must be opened with an ACL that allows a particular type of traffic to move from a lower security network to a higher security network. In this case, however, it is SMTP or e-mail traffic instead of Web traffic that is being allowed through.

In the figure, the ACL named acl_dmz_in is applied to traffic inbound to the DMZ interface. The ACL acl_dmz_in permits the host 172.16.0.4 mail access to the internal mail server on the inside interface. All other traffic originating from the DMZ network is denied.