Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Configuration difficulties with DMZ


I test a pix with several configurations. I'm able to configure my Pix with inside an outside (no dmz).

Now I activate dmz, but I've a problem.

-I'm able to access everything from inside to outside

-I'm able to access everything from inside to dmz (with

-I'm able to access everything from dmz to outside

-I'm able to access in http from outside to dmz (with

-I'm able to access to port 1433 and vpn (pptp+gre) from outside to inside (with

But I'm not able to access to port 1433 from dmz to inside.

Here is the config with just the "I'm able to" thinks. I don't know how I can access port 1433 from outside to my SQL Server in inside.

Another think: I can't use IP from outside interface ( to access to port 1433 and vpn. It' not really a problem, but I don't understand why.

And the last question: Is the Cisco VPN client free to download? I'm not able to use l2tp/ipsec vpn connection with MS vpn client.

Thanks in advance to all.

PS: please be patient, i'm not completely stupid (I hope :o), just beginer and I've some difficulties with English.


: Saved


PIX Version 7.2(2)14


hostname pix


enable password xxx



interface Ethernet0

nameif outside

security-level 0

ip address


interface Ethernet1

nameif inside

security-level 100

ip address


interface Ethernet2

nameif dmz

security-level 10

ip address


passwd xxx

ftp mode passive

dns server-group DefaultDNS


access-list outside_access_in extended permit tcp any host eq www

access-list outside_access_in extended permit tcp host host eq 1433

access-list outside_access_in extended permit tcp host host eq pptp

access-list outside_access_in extended permit gre host host

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image flash:/asdm522-58.bin

no asdm history enable

arp timeout 14400


global (outside) 1 interface

global (dmz) 1 interface

nat (inside) 1

nat (dmz) 1

static (dmz,outside) netmask

static (inside,outside) netmask

access-group outside_access_in in interface outside

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

http server enable

http outside

http inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address inside

dhcpd enable inside



class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect pptp

inspect http


service-policy global_policy global

prompt hostname context


: end

Hall of Fame Super Blue

Re: Configuration difficulties with DMZ


if you want to access an inside server from the DMZ you are missing a static statement ie.

you have

"static (inside,outside) netmask"

You need a static for the inside to the DMZ

ie. static (inside,DMZ) netmask

You will also need an access-list to allow the traffic to come from the DMZ to your inside server.



New Member

Re: Configuration difficulties with DMZ


I've tried something like your exemple and that's work.

Thank you.


CreatePlease to create content