PIX dmz configuration

Unanswered Question
Feb 26th, 2009
User Badges:

i have a pix520 running 6.3, i have access to the outside from both the dmz and inside but cant seem to figure out how to allow access to the dmz from the inside, network as follows, dmz int, inside, outside 81.*.*.*, default route to outside next hop router. acl states, tcp permit an any eq www, ......help wanted please.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
eddie.mitchell@... Thu, 02/26/2009 - 05:05
User Badges:
  • Silver, 250 points or more

What does your inside ACL and NAT configuration look like? I would suggest posting a sanitized version of your configuration.

eddie.mitchell@... Thu, 02/26/2009 - 14:18
User Badges:
  • Silver, 250 points or more

So, you're trying to access the DMZ from the inside?

I would add the following:

access-list nonat extended permit ip

nat (inside) 0 access-list nonat

I would also recommend adding an ACL to the inside interface to restrict the outbound access.

mick_flynn Thu, 02/26/2009 - 14:37
User Badges:


with access-list bound to the inside int, i would still need to apply a 'permit ip any any' on the second line would i not?

eddie.mitchell@... Thu, 02/26/2009 - 14:49
User Badges:
  • Silver, 250 points or more

The access-list I posted for you is not being bound to an interface. This is a nat exemption ACL which is telling the PIX to not perform NAT on traffic flowing from the inside to the DMZ network.

What I was suggesting was creating another ACL and applying this to the inside interface of the pix via 'access-group in interface inside' in order to restrict outbound traffic to the DMZ and the Internet for security reasons. It is always best to permit only those services that are necessary and no more. This means never using 'permit ip any any' statements.

mick_flynn Thu, 02/26/2009 - 14:57
User Badges:

eddie, many thanks.

I am only using this config to test for access between the inside/dmz and vice versa, once this has been established i will alter the config to only allow smtp as a mail server will be placed on the dmz.

Did you see my original config?

can you please tell me what an ACL would look like?

kind regards.

Tshi M Thu, 02/26/2009 - 05:24
User Badges:
  • Silver, 250 points or more

What is your inside subnet? I assume it is Try the command below:

static (inside,dmz) netmask 0 0

mick_flynn Thu, 02/26/2009 - 14:52
User Badges:


i have tried that and with an access-list bound to the inside but didnt work, it blocked traffic from inside to outside.

i am missing something...

please see attached test config.

Tshi M Thu, 02/26/2009 - 15:04
User Badges:
  • Silver, 250 points or more


please try to change the following:

static (inside,dmz) netmask 0 0


static (inside,dmz) 10.1.0. netmask

Also: try this without using an inside ACL at first. Once you have it running than you can move on to applying ACL as you see fit.



This Discussion