I have a pix 515 with 3 interfaces, the outside interface and the DMZ interface are different subnets of one main net, which means that I have a legal net ( 220.127.116.11/26, the outside interface and the DMZ interface are 18.104.22.168/27 and 22.214.171.124/27, all the www and mail servers are located in the DMZ. One Router is outside of the PIX.
I have add the routes on the router to the DMZ net.
The problem is from the inside I can reach anywhere which I certainly use the nat, but from the DMZ I can not reach anywhere.
the configuration is below:
PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
enable password xxxx encrypted
passwd xxxxx encrypted
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
access-list 101 permit icmp any any
access-list 101 permit tcp any host 126.96.36.199 eq domain
access-list 101 permit udp any host 188.8.131.52 eq domain
access-list 101 permit tcp any host 184.108.40.206 eq www
access-list 101 permit tcp any host 220.127.116.11 eq ftp
access-list 101 permit tcp any host 18.104.22.168 eq smtp
access-list 101 permit ip any any
access-list 102 permit ip any any
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside xxxx.xxx.xxx.59 255.255.255.224
I agree with Aad (good to see you here Aad *grin*)
The permit ip any any will drill a serious securityhole in your PIX. Your PIX is open to any traffic with this command (not implicit command like the other guy stated, cause the implicit rule depending on securitylevels is never seen in config)
If you do not want the servers on the dmz to be reachable from the outside, the nat (dmz) 1 0.0.0.0 0.0.0.0 will do
The static commands provides you with the ability to let the PIX proxy-ARP on the outside interface for these adresses (no further config needed)
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...