Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

PIX 515 W/VPN and Web access

Help me please as I have run into a wall and can't figure this out. I have a PIX 515-BUN-UR running ver 6.2 of the PIX Firewall IOS with a 4-port serial card and the 3DES accellerator board. I have the VPN up and running sucessfully but now need to add a web server on the DMZ-1 interface.

The PIX is located directly after the Telco Border Router and has been assigned the address range of Router interface is, PIX is NAT is set to and PAT is set to I want the WEB service on is used for the IDS box between the Firewall and the Border Router.

I have added the following lines to the Firewall Config to set up the http access, but am unable to get into the web server:

access-list VPN permit ip ODH

access-list WEB permit tcp any host eq www

access-group WEB in interface outside

ip address outside

ip address inside

ip address DMZ-1

global (outside) 1

global (outside) 1

global (DMZ-1) 1 WebServer netmask

nat (inside) 0 access-list VPN

nat (inside) 1 ODH 0 64

nat (DMZ-1) 1 0 10

static (DMZ-1,outside) WebServer netmask 0 10

route outside 1

route inside 1

route inside OSHQ 1

If it makes any difference, I am also unable to ping the host on the DMZ-1 interface from the PIX console. The Web Host can be ping'd from a switch console, however the PIX interface cannot.

Can anyone please point me in the right direction.

Thanks in advance.

Cisco Employee

Re: PIX 515 W/VPN and Web access

Remove this:

global (DMZ-1) 1 WebServer netmask

What you're saying here is that any packets coming from the inside interface going to the DMZ will be translated to the web server's address, not good. Basically you've told the PIX that it owns the web servers address, so it will answer ARP queries for it, etc, etc.

If you have users going from inside to DMZ then do something like the following:

global (DMZ-1) 1 netmask

nat (inside) 1 ODH 0 64

where is any UNUSED IP address on the DMZ. The static that you have should take care of the outside -> DMZ translation and let everything in.

Community Member

Re: PIX 515 W/VPN and Web access


Thanks. That was it. So close but yet so far.

CreatePlease to create content