Artemis Hospital Infrastructure: Cisco ASA 5510 DMZ Segmentation & S2S IPSec VPN

“Hospital network security is a matter of life and safety. If an unauthorized workstation accesses the PACS imaging database or HIS patient record VLAN, operations freeze.”

The Setup

In January 2009 at HCL Infosystems Ltd, I served as a Network Administrator (On-the-Job Training) managing the core network and security infrastructure for Artemis Hospital in Gurgaon.

The hospital relied on a Cisco ASA 5510 Adaptive Security Appliance running Adaptive Security Algorithm (ASA) 8.0, acting as the perimeter firewall, DMZ gateway, and Remote Access / Site-to-Site IPSec VPN concentrator for diagnostic clinics.

The Mess

The initial hospital network configuration placed PACS (Picture Archiving and Communication System) DICOM servers, HIS (Hospital Information System) database servers, and public Wi-Fi on the same flat Layer 2 network segment.

During a night shift, a infected laptop plugged into a consultation room port triggered a broadcast storm. The Cisco ASA CPU hit 100%, causing IPSec VPN tunnels to remote diagnostic centers to drop:

[CRITICAL] 2009-01-12 01:15:04 IST - Cisco ASA 5510 Console Log
%ASA-1-106021: Deny TCP (no connection) from 192.168.1.105/445 to 192.168.1.200/445 on interface inside
%ASA-3-210007: LU allocate block failed
Cisco ASA 5510 Status: CPU 99.8% (Process: MCAST/BCAST FLOOD).
Result: Site-to-Site IPSec VPN Tunnel 'S2S-DIAGNOSTIC-CLINIC-01' DOWN (ISAKMP Phase 1 Rekey Failed).

Because there was no DMZ isolation, SMB malware traffic flooded the inside interface and brought down external VPN connectivity for remote clinics transmitting MRI scans.

The Solution

Under senior guidance, I re-architected the ASA 5510 security zones, introducing strict DMZ segmentation and encrypted site-to-site IPSec VPN tunnels:

1. Security Zone Segmentation: Created dedicated security levels: INSIDE (Security 100), DMZ_HIS_PACS (Security 50), and OUTSIDE (Security 0).
2. Access Control List Pinholes: Explicitly allowed only DICOM TCP port 104 and HTTPS port 443 between consultation VLANs and DMZ servers.
3. Redundant S2S IPSec VPN Tunnels: Re-built IPSec VPN tunnels with 3DES/SHA-1 encryption and automated Keepalive DPD (Dead Peer Detection).

! Cisco ASA 5510 Security Zone & DMZ Pinhole Configuration
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 203.197.10.2 255.255.255.248
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.10.1 255.255.255.0
!
interface Ethernet0/2
 nameif dmz_pacs
 security-level 50
 ip address 10.10.50.1 255.255.255.0
!
access-list INSIDE_TO_DMZ extended permit tcp 192.168.10.0 255.255.255.0 host 10.10.50.10 eq 104
access-list INSIDE_TO_DMZ extended permit tcp 192.168.10.0 255.255.255.0 host 10.10.50.20 eq 443
access-group INSIDE_TO_DMZ in interface inside

# Verify Crypto IPSec SA Status on Cisco ASA
asa5510# show crypto ipsec sa
interface: outside
    Crypto map tag: OUTSIDE_MAP, seq num: 10, local addr: 203.197.10.2
    local ident (addr/mask/prot/port): (10.10.50.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
    #pkts encaps: 14205, #pkts encrypt: 14205, #pkts digest: 14205
    #pkts decaps: 14198, #pkts decrypt: 14198, #pkts verify: 14198
    Status: ACTIVE (0 Drops)

The Results

Isolating healthcare systems behind the Cisco ASA 5510 DMZ secured Artemis Hospital:

• VPN Tunnel Reliability: Achieved 99.9% IPSec tunnel stability across remote diagnostic clinics.
• Broadcast Storm Protection: DMZ security levels isolated 100% of internal workstation broadcast traffic from core HIS/PACS servers.
• Incident MTTR: Reduced remote clinic VPN connection troubleshooting from hours to 5 minutes.

Key Takeaway

Never run mission-critical medical or ERP databases on a flat LAN. Segmenting infrastructure into explicit DMZ security zones with Cisco ASA pinholes guarantees system availability even during internal network storms.

Architecture and decisions: mine. ASA CLI configs & OJT debugging: mine. AI assistance: structure, syntax, first draft. — Sachin