I am trying to find a way to have multiple hosts inside a DMZ be able to access my entire internal network. Does anyone know of a way to do this without creating individual statics for every device that may be accessed?
If you have only one DMZ it is very easy with access list, you have to just do following, assuming you want to permit all the dmz and inside hosts to go anywhere (Including internet) freely:
But if have multiple DMZs (say 4) and you want only specific hosts on inside/dmz to access specific hosts/services then you have to be a little more specific. In the config below we assume that you have 4 dmzs :
1. we have restricted all the hosts on all the interface from accessing IRC on the internet but have allowed all other internet services to be accessed.
2. All the hosts on the inside are free to access any host on any interface.
3. All dmz1 hosts are allowed to access all inside, dmz3 and internet (except IRC:6667) but they can't access hosts on dmz2 and dmz4.
4. Hosts on dmz2,3,4 can access only internet (except IRC:6667).
So if you are using an access-list you can connect directly to hosts on your internal network by their real (not NATed) IP address? I thought you had to do statics to go from a less trusted (dmz) to a more trusted (inside) network.
I am sorry, I forgot to include two very important config entries. After putting this DMZ hosts can access inside hots with their real IP address and you don't have to put any "static (inside,dmz1)" statement
-------------------------------------------
access-list acl_no_nat permit ip 172.16.1.0 255.255.255.0 172.16.0.0 255.255.255.0
With "nat 0" you don't need any static to access from dmz1 to inside and with tying it to access-list there is no problem in initiating a session from dmz1. I have this configuration working.
