PIX 535 connectivity issue

[habibd]

Hi,

I have pix 535 with 6.2(2). I have the inside with address as 172.20.10.0/24, with 172.20.10.1 as the pix interface. One of the DMZ's that is DMZ-corporate, with network 172.20.30.0/24, and 172.20.30.1 as the pix interface address.

I have configured the route command, the output of show route

idcm-p535-mnpr# sh route

outside 0.0.0.0 0.0.0.0 200.90.134.2 1 OTHER static

FailOver 172.10.9.0 255.255.255.252 172.10.9.1 1 CONNECT static

DMZ-Mon 172.16.15.0 255.255.255.0 172.16.15.1 1 CONNECT static

DMZ-Mon 172.16.16.0 255.255.255.0 172.16.15.5 1 OTHER static

inside 172.20.10.0 255.255.255.0 172.20.10.1 1 CONNECT static

inside NOC-Operators 255.255.255.0 172.20.10.2 1 OTHER static

DMZ-Signaling 172.20.19.0 255.255.255.0 172.20.20.2 1 OTHER static

DMZ-Signaling 172.20.20.0 255.255.255.0 172.20.20.1 1 CONNECT static

DMZ-Corporate 172.20.30.0 255.255.255.0 172.20.30.1 1 CONNECT static

DMZ-Collocation 200.90.128.0 255.255.255.0 200.90.128.1 1 CONNECT static

DMZ-TCI-Services 200.90.132.0 255.255.255.0 200.90.132.1 1 CONNECT static

I am not able to communicate either from 172.20.10.0 network to 172.20.30.0 n/w or vise versa.

What am I missing. I have the pix as the default gateway on the devices in the respective networks.

Appreciate comments.

Thanks,

Habib

[Nairi Adamian]

To enable connectivity from inside to dmz, you also need to have nat (inside) and global (dmz) commands configured.

http://www.cisco.com/warp/public/707/28.html#topic1

hope this helps,

~Nairi

[habibd]

Hi Nairi,

Thanks for the info.

One clarification, so to communicate from a higher security to a lower security interface you require NAT. And for Communicating from lower security to higher security interface you require some sort of translation. This translation is it only static translation only or I can use something else.

What my concern is, I was thinking that if I have a route on the PIX to various network and when a packet comes from one network to go to the other, the routes are not enough and you require some translation.

Appreciate your clarification.

Thanks,

Habib Dashti