Cisco Support Community
Community Member

Setup Pix 515E infront of ISA Server 2004

Can anyone help me with setting up this network layout with my Pix Firewall.

Network Layout : Pix > DMZ > ISA Server 2004 > Exchange Server 2003 + Users.

Pix outside IP Address :

Pix inside IP Address :

DMZ IP Addresss :

ISA Server outside IP :

ISA Server inside IP :

I've identified the interfaces IP Address and named all plus the following config:

global (outside) 1 interface

nat (inside) 1 0 0

nat (dmz) 1 0 0

conduit permit icmp any any

route outside 1

I can now access the internet from my ISA Server in the DMZ zone.

I am intending to put the ISA Server out on the DMZ to access the outside world with

static (dmz,outside) netmask 0 0

and then open all traffic to ISA with

access-list acl_out permit ip any host any

access-group acl_out in interface outside

then I?ll give ISA server access to the inside network with

access-list acl_dmz permit tcp eq 25

access-group acl_dmz in interface dmz

With the above commands, the first access-list acl_out was not accepted by pix plus the second access-list acl_dmz so if you could please share some light upon my configurations.




Re: Setup Pix 515E infront of ISA Server 2004

What version of PIX software are you using? The "conduit" command is no depricated, and if possible you should use access-list instead, you need

access-list permit icmp any any eq echo-reply

The reason acl_out doesn't work is that you have defined the host address incorrectly, and you cannot define the port on ip traffic, just tcp or udp.


access-list acl_out permit ip any

The reason acl_dmz doesn't enter correctly is that you are using host IP addresses, but network masks.


access-list acl_dmz permit tcp eq 25

Personaly I would not use the PIX interface on the static mapping to the DMZ address, especialy as you seem to have a full class C internet subnet.

Also using a class B subnet for the DMZ seems to be overkill, do you really expect to have 64000 IP address?

Lastly, ISA 2004 acts as a firewall itself, you should protect it from the internet by the PIX but there should be no issue having one interface on the DMZ and another on the Inside, in fact I don't know how it will act with two interfaces on the DMZ network.

CreatePlease to create content