PIX Access list

Answered Question
Nov 30th, 2009

Hi Guys,

I have a question about access list on pix. I have a host on inside say 1.1.1.1 which wants to talk to host 2.2.2.2 in DMZ1. I applied the access-list on the inside interface and it is working. How about if host 2.2.2.2 wants to talk to host 1.1.1.1. Do I need an access list from DMZ1 to inside?

Tks

I have this problem too.
0 votes
Correct Answer by Jon Marshall about 7 years 1 month ago

kuldeep.kaur wrote:

Hi Guys,

I have a question about access list on pix. I have a host on inside say 1.1.1.1 which wants to talk to host 2.2.2.2 in DMZ1. I applied the access-list on the inside interface and it is working. How about if host 2.2.2.2 wants to talk to host 1.1.1.1. Do I need an access list from DMZ1 to inside?

Tks

For return traffic from 2.2.2.2 to 1.1.1.1 no you don't.

If 2.2.2.2 starts a new connection then yes you do need an acl and you also need to either

1) have a statc NAT statement eg.  static (inside,dmz) 1.1.1.1 1.1.1.1 netmask 255.255.255.255

2) have a NAT exemption eg.

    access-list NONAT permit ip host 1.1.1.1 host 2.2.2.2

    nat (inside) 0 access-list NONAT

3) If the pix is running v7.x or later you can disable NAT altogether on the firewall eg.  no nat-control

Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Mon, 11/30/2009 - 13:56

kuldeep.kaur wrote:

Hi Guys,

I have a question about access list on pix. I have a host on inside say 1.1.1.1 which wants to talk to host 2.2.2.2 in DMZ1. I applied the access-list on the inside interface and it is working. How about if host 2.2.2.2 wants to talk to host 1.1.1.1. Do I need an access list from DMZ1 to inside?

Tks

For return traffic from 2.2.2.2 to 1.1.1.1 no you don't.

If 2.2.2.2 starts a new connection then yes you do need an acl and you also need to either

1) have a statc NAT statement eg.  static (inside,dmz) 1.1.1.1 1.1.1.1 netmask 255.255.255.255

2) have a NAT exemption eg.

    access-list NONAT permit ip host 1.1.1.1 host 2.2.2.2

    nat (inside) 0 access-list NONAT

3) If the pix is running v7.x or later you can disable NAT altogether on the firewall eg.  no nat-control

Jon

Actions

This Discussion