Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

problem for inside users accessing dmz server

I'm facing problem where inside users unable to get to the dmz server,try the vice versa as well,not working.PLs advise.My router is doing the nat for accesing net.

Saved

: Written by enable_15 at 04:09:29.685 UTC Fri Jan 1 1993

PIX Version 6.2(2)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz security10

enable password xxxxxxxencrypted

passwd xxxxxxxxencrypted

hostname test

domain-name test

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

name 192.168.101.1 rosettanet

name 192.168.100.0 LAN

name 192.168.100.2 ERP

name 192.168.100.1 PDC

object-group service MSFileTransfer tcp-udp

description Services needed for MS File Sharing

port-object range 137 139

port-object eq echo

port-object eq 445

access-list inside_access_in permit tcp LAN x.x.x.0 any eq www

access-list inside_access_in permit icmp any any echo

access-list inside_access_in permit icmp any any echo-reply

access-list inside_access_in permit udp LAN x.x.x.0 any eq domain

access-list inside_access_in permit tcp host PDC host rosettanet object-group MS

FileTransfer

access-list inside_access_in permit tcp host ERP host rosettanet object-group MS

FileTransfer

access-list inside_access_in permit ip any any

access-list dmz_access_in permit tcp any any eq www

access-list dmz_access_in permit icmp any any echo-reply

access-list dmz_access_in permit icmp any any echo

access-list dmz_access_in permit tcp host rosettanet host PDC object-group MSFil

eTransfer

access-list dmz_access_in permit tcp host rosettanet host ERP object-group MSFil

eTransfer

access-list dmz_access_in permit udp any any eq domain

access-list dmz_access_in permit ip any any

access-list outside_access_in permit tcp any host 192.168.102.2 eq www

access-list outside_access_in permit icmp any any echo-reply

access-list outside_access_in permit icmp any any echo

access-list outside_access_in permit tcp any host 192.168.102.3 eq 5900

access-list temp permit ip any any

pager lines 24

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip address outside 192.168.102.1 255.255.255.0

ip address inside 192.168.100.254 255.255.255.0

ip address dmz 192.168.101.254 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location PDC x.x.255.255 inside

pdm location rosettanet x.x.255.255 dmz

pdm location ERP x.x.255.255 inside

pdm location 192.168.102.254 255.255.255.255 outside

pdm logging emergencies 100

pdm history enable

arp timeout 14400

global (outside) 1 192.168.101.199 netmask x.x.255.0

global (dmz) 1 192.168.101.200-192.168.101.250 netmask 255.255.255.0

nat (inside) 1 LAN x.x.255.0 0 0

nat (dmz) 1 192.168.101.0 255.255.255.0 0 0

static (dmz,outside) 192.168.102.2 rosettanet netmask 255.255.255.255 0 0

static (inside,outside) 192.168.102.3 PDC netmask x.x.255.255 0 0

static (inside,dmz) rosettanet PDC netmask x.x.255.255 0 0

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

access-group dmz_access_in in interface dmz

route outside 0.0.0.0 0.0.0.0 192.168.102.254 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http PDC x.x.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

no sysopt route dnat

telnet 192.168.102.254 255.255.255.255 outside

telnet 0.0.0.0 0.0.0.0 outside

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh timeout 5

terminal width 80

Cryptochecksum:xxxxx

4 REPLIES
Cisco Employee

Re: problem for inside users accessing dmz server

What does the syslog say? Always, always, always turn on syslogging when you have connection problems thru the PIX, it'll tell you exactly what's going on.

logging on

logging buffer debug

Try a connection, then:

sho logg

What are the exact source and destination IP addresses involved here, and "get to the dmz server" with what protocol? Please provide as much information as you can in order for us to help you out.

New Member

Re: problem for inside users accessing dmz server

Is my setting correct?

Cisco Employee

Re: problem for inside users accessing dmz server

Can you answer my previous questions?

New Member

Re: problem for inside users accessing dmz server

I would start with turning on "debug icmp trace" than ping from the DMZ to the inside and see where the pings are stopping. How come no routes to the inside? Is your DMZ set up properly on the router and switch?

104
Views
0
Helpful
4
Replies
CreatePlease login to create content