Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

From dmz to subinterface on inside (PIX 515E)


I'm trying to get a few of our machines on dmz to communicate with a TSM server which is located on a subnet on the inside. But I can't get it to route traffic out on the subinterface I have created in the pix, it keeps using the dmz as output interface, instead of the subinterface.

Server on dmz:

Subinterface on inside interface: (name: BackupLAN)

TSM server: (name: TSMserver)

The following NATs are used:

static (BackupLAN,dmz) TSMserver TSMserver netmask

static (dmz,BackupLAN) netmask

The following route is created:

route BackupLAN TSMserver 1 ( is a switch which passes the traffic on to the TSM server)

There is also a security policy for incoming on dmz which only allows traffic with destination port 1500 to be passed on.

When running the Packet tracer in ASDM, the result is that the packet is allowed, but both input and output interface is dmz, output interface should be BackupLAN.

Is there something I have forgot to configure? Or is anything wrong configured?


Re: From dmz to subinterface on inside (PIX 515E)

Could you post a show route.

New Member

Re: From dmz to subinterface on inside (PIX 515E)

Here are the routes:

Gateway of last resort is to network

C is directly connected, BackupLAN

S TSMserver [1/0] via, BackupLAN

C is directly connected, outside

C is directly connected, dmz

C is directly connected, inside

S* [1/0] via, outside

New Member

Re: From dmz to subinterface on inside (PIX 515E)

What security level is configured for BackupLAN and dmz? Also, which network does the TSMserver sit on?

New Member

Re: From dmz to subinterface on inside (PIX 515E)

BackupLAN has securitylevel 100, dmz has 10

The TSMserver resides on a remote network. From the PIX the link goes via a local switch ( in the configuration) and then to a remote switch (still in the .120 subnet) and then it reaches the TSMserver

Hall of Fame Super Blue

Re: From dmz to subinterface on inside (PIX 515E)


Firstly what is the second static doing ie.

static (dmz,BackupLAN) netmask

This is not needed as far as i can see so maybe remove it and see if that makes any difference. I can't see why it would at the moment but your config/routing looks okay.

Also can you ping the TSMServer from the pix firewall itself


New Member

Re: From dmz to subinterface on inside (PIX 515E)

It doesn't do much really. Put it there in case of need or something. But it's no difference without that NAT rule.

I can't ping the TSMserver from the PIX, eventhough I choose the BackupLAN interface in the ping console.