Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Access DMZ ffom Inside


I've got a web server in the DMZ (single IP address). I somehow managed to get the users from the inside interface to access the web server in the DMZ but sometimes its takes about 20 to 30 seconds to show up which is way too long. Is this to do with my DNS settings or with the PIX settings? Which of the two settings below should I use for the pix?

DMZ Subnet: /

DMZ web server:

Inside Subnet: /

static (inside,dmz) netmask

acl dmz permit tcp eq 80

access-group dmz in interface dmz

or no nat?

access-list nonat extended permit ip

nat (inside) 0 access-list nonat

Or should I create and ip pool?

If it's none of the above, could you please give me a suggestion of what to do (what config I should enter)?

Thanks. Appreciate it.

Hall of Fame Super Blue

Re: Access DMZ ffom Inside


You do not need the access-list

acl dmz permit tcp eq 80

access-group dmz in interface dmz

because the firewall is stateful so if the connection is initiated from the inside to the DMZ the return traffic will be allowed. So remove the access-list.

Static or nonat shouldn't make much differenc.

Are youi accessing the web server on the URL or by IP address. If URL how is that being resolved ?


New Member

Re: Access DMZ ffom Inside

I'm accessing the web server in DMZ through URL. I've got DNS server on the inside and on the webserver in DMZ I also installed own DNS. I've entered records for web server on inside DNS to resolve name. Something else I should do?