Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Pix 515 DMZ routing question

Hi,

I have a public /24 address range that i want to apply to a DMZ on a pix 515. The outside interface on the pix is connected to a Cisco router using an private address 10.x.x.x This router is running bgp and eigrp. I need to advertise the DMZ range in BGP and allow traffic from the internet to the DMZ on the pix.The issue i seem to be having is getting the traffic from the router to the DMZ. At the moment there are no access-lists in place anywhere and the router has routes to the pix. By debugging icmp on the pix i can see the inbound icmp traffic hitting the pix ok but the pix doesnt reply. I have tried this with static and eigrp routes on both the router and pix.

Any help much appreciated...

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Pix 515 DMZ routing question

No problem at all, many people are stumped by this :)

Please rate helpful posts.

Regards

Farrukh

5 REPLIES

Re: Pix 515 DMZ routing question

If you don't apply an ACL on the outside interface (lower security) how will it communicate with the DMZ interface (higher security)? Also by the PIX/ASA rules you will not be able to ping the DMZ interface itself from the Router on the outside, Try to ping something 'behind' the DMZ interface, like a web-server etc.

Regards

Farrukh

New Member

Re: Pix 515 DMZ routing question

I did have an acl permit ip any any on the outside to start with but deleted to test..

Can i ask why i cant ping the DMZ interface from the outside router?

Re: Pix 515 DMZ routing question

This is just one of the 'rules' in the Cisco Firewall perhaps to keep the firewal's zones 'stealth' in a way (I know its lame :) ).

You cannot ping any of its interfaces THROUGH another interface (by default). Put the ACL back and try to test using something other than ping.

outside-router#>telnet dmz-server

Regards

Farrukh

New Member

Re: Pix 515 DMZ routing question

Yup you were correct. Didn't know u cant ping DMZ int address.

Thanks very much all good now...

Re: Pix 515 DMZ routing question

No problem at all, many people are stumped by this :)

Please rate helpful posts.

Regards

Farrukh

117
Views
0
Helpful
5
Replies