Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX dmz configuration

i have a pix520 running 6.3, i have access to the outside from both the dmz and inside but cant seem to figure out how to allow access to the dmz from the inside, network as follows, dmz int 10.1.10.1, inside 10.1.0.1, outside 81.*.*.*, default route to outside next hop router. acl states, tcp permit an any eq www, ......help wanted please.

11 REPLIES

Re: PIX dmz configuration

What does your inside ACL and NAT configuration look like? I would suggest posting a sanitized version of your configuration.

New Member

Re: PIX dmz configuration

Many thanks for your reply, please find attached my config.

Re: PIX dmz configuration

So, you're trying to access the DMZ from the inside?

I would add the following:

access-list nonat extended permit ip 10.1.0.0 255.255.255.0 10.1.10.0 255.255.255.0

nat (inside) 0 access-list nonat

I would also recommend adding an ACL to the inside interface to restrict the outbound access.

New Member

Re: PIX dmz configuration

eddie,

with access-list bound to the inside int, i would still need to apply a 'permit ip any any' on the second line would i not?

Re: PIX dmz configuration

The access-list I posted for you is not being bound to an interface. This is a nat exemption ACL which is telling the PIX to not perform NAT on traffic flowing from the inside to the DMZ network.

What I was suggesting was creating another ACL and applying this to the inside interface of the pix via 'access-group in interface inside' in order to restrict outbound traffic to the DMZ and the Internet for security reasons. It is always best to permit only those services that are necessary and no more. This means never using 'permit ip any any' statements.

New Member

Re: PIX dmz configuration

eddie, many thanks.

I am only using this config to test for access between the inside/dmz and vice versa, once this has been established i will alter the config to only allow smtp as a mail server will be placed on the dmz.

Did you see my original config?

can you please tell me what an ACL would look like?

kind regards.

Bronze

Re: PIX dmz configuration

What is your inside subnet? I assume it is 10.1.0.0/24. Try the command below:

static (inside,dmz) 10.1.0.0 10.1.0.0 netmask 255.255.255.0 0 0

New Member

Re: PIX dmz configuration

many thanks for your reply, i have attached a copy of my config to my last reply.

kind regards.

New Member

Re: PIX dmz configuration

thanks,

i have tried that and with an access-list bound to the inside but didnt work, it blocked traffic from inside to outside.

i am missing something...

please see attached test config.

Bronze

Re: PIX dmz configuration

Hi,

please try to change the following:

static (inside,dmz) 10.1.10.2 10.1.10.2 netmask 255.255.255.255 0 0

to:

static (inside,dmz) 10.1.0.0 10.1.0. netmask 255.255.255.0

Also: try this without using an inside ACL at first. Once you have it running than you can move on to applying ACL as you see fit.

rgds,

New Member

Re: PIX dmz configuration

etienne, many thanks

I will give it a try.

regards.

138
Views
0
Helpful
11
Replies