Problem:
I am trying to setup my Cisco 1721 to route traffic from a WAN to two Ethernet interfaces where one is a DMZ and the other is a trusted LAN with NAT. I am having trouble getting the correct configuration built that allows both the DMZ and the LAN to access the internet(HTTP).
Equipment:
I have a Cisco 1721 with an enterprise 12.4 IOS. In the router is one FastEthernet and two Ethernet ports.
Layout:
Eth0 - 10.1.1.1/24 DMZ
Eth1 - DHCP WAN
Fa0 - 192.168.1.1/24 LAN
My current configuration:
The configuration is stripped down. At the moment, I'm trying to get internet(HTTP) access to the DMZ. With this configuration, the LAN has HTTP access but the DMZ doesn't. However, the DMZ can ping out and you can see it in the NAT translation table. You can find the show command after the configuration.
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW netshow
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip inspect name SDM_LOW ntp
no ip ips deny-action ips-interface
!
!
interface Ethernet0
description DMZ
ip address 10.1.1.1 255.255.255.0
ip access-group 103 in
ip nat inside
ip inspect SDM_LOW out
ip virtual-reassembly
full-duplex
!
interface Ethernet1
description WAN$FW_OUTSIDE$
ip address dhcp
ip access-group 101 in
ip nat outside
ip inspect SDM_LOW out
ip virtual-reassembly
half-duplex
!
interface FastEthernet0
description Trusted
ip address 192.168.1.1 255.255.255.0
ip access-group 100 in
ip nat inside
ip inspect SDM_LOW out
ip virtual-reassembly
speed auto
!
ip classless
!
ip nat inside source list 1 interface Ethernet1 overload
!
access-list 1 remark NAT ACL
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 10.1.1.0 0.0.0.255
access-list 100 permit ip any any
access-list 101 permit ip any any
access-list 103 permit ip any any
router(config-if)#do sh ip nat tra
Pro Inside global Inside local Outside local Outside global
icmp 208.xx.xx.xx:512 10.1.1.2:512 4.2.2.2:512 4.2.2.2:512
icmp 208.xx.xx.xx:1024 192.168.1.19:1024 205.171.3.65:1024 205.171.3.65:1024
Anyone have a suggestion on why I cannot access the web(HTTP) on the DMZ?
