PIX 515 with DMZ probs

Unanswered Question
Aug 17th, 2007

I'm trying to setup an SSL VPN box within a DMZ using a PIX 515.

Basically I've setup the SSL box with a DMZ IP and NAT'd this to an external IP. I've put the following ACLs in:

access-list INCOMING permit tcp any object-group SSL_BOX object-group WEB_BROWSING_PORTS

access-list DMZ permit tcp host object-group INTRANET_SERVERS eq www

access-list DMZ permit tcp host object-group DOMAIN_CTRLRS object-group DC_PORTS

access-list DMZ permit tcp host object-group CITRIX_SERVERS object-group CITRIX_PORTS

access-list DMZ deny ip any any

However, I can get to the SSL box externally, but it's not passing from there to the internal LAN.

I've done a show ACL DMZ, but the hit count on all entries is 0. Is there a way I can troubleshoot this to see where it's getting held up. I've tried viewing on a SYSLOG server with a DEBUG ACL but it's not helping much.

any help much apprec.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Fri, 08/17/2007 - 08:10


Quick check. Do you have static translations for the internal servers to the DMZ eg if one of your DC's was

static (inside,DMZ) netmask

if so could you post config ?

What version of pix software are you running ?


andymh Mon, 08/20/2007 - 01:02

Thanks Jon, PIX s/w is ver 6.3(4)

I was kind of thinking along the lines of what you were saying here. I have a:

static (outside,DMZ) 194.x.x.x netmask

but all the internal servers are on 10 addresses. I presume that I need some kind of translations for the Netilla box ( to be able to see them internally ?


Jon Marshall Mon, 08/20/2007 - 01:56


What is the static (outside,DMZ) 194.x.x.x netmask meant to do ?

if you are presenting your Netilla box to the outside as 194.x.x.x your statement should be

static (DMZ,outside) 194.x.x.x netmask

As for your internal servers yes you need to present them to the DMZ ie.

static (inside,DMZ) "internal 10.x.x.x server address" "internal 10.x.x.x server address" netmask



andymh Mon, 08/20/2007 - 03:39


tRyping error, did it from memory rather than cut and paste (it's been a heavy wkd !!) - will try what you said. That sounds like it should sort it.



This Discussion