Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Setting up Pix 515 with 3 interfaces and a remote location.

I have a problem setting up a pix for one of our customers.

The network i'm dealing with consist of a 1602 router on the outside, the pix, an inside network and a DMZ.

The DMZ is my problem. The following is connected to the ports of the pix:

Outside port: Cisco 1601 router

Inside port: 3com switch

DMZ port: cisco 1720 router (locally) connecting via T1 static line to another 1720 router at a remote location.

Now, we are supposed to use nat, which is fine with me. I chose a range of 10.0.0.x for the inside and a range of 10.0.1.x for the DMZ (to have different subnets). How can i make the DMZ remote part work with the pix through the 2 1720 routers?

The pix is not in place yet, this is all theoretically.

The configs:


PIX Version 6.1(1)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz security50

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname kkfirewall

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000


pager lines 24

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip address outside 12.x.x.131

ip address inside

ip address dmz

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 12.x.x.132-12.x.x.190

global (outside) 1 12.x.x.191

nat (inside) 1 0 0

static (inside,dmz) netmask 0 0

static (inside,outside) 12.x.x.130 netmask 0 0

conduit permit icmp any any

conduit permit ip

conduit permit tcp host 12.x.x.130 eq www any

conduit permit tcp host 12.x.x.130 eq smtp any

conduit permit tcp host 12.x.x.130 eq pop3 any

conduit permit tcp host 12.x.x.130 eq ftp any

conduit permit tcp host 12.x.x.130 eq ftp-data any

conduit permit udp host 12.x.x.130 eq dnsix any

conduit permit tcp host 12.x.x.130 eq telnet

conduit permit tcp host 12.x.x.130 eq 7000

route outside 12.x.x.129 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

no sysopt route dnat

telnet inside

telnet dmz

telnet timeout 15

ssh timeout 5

terminal width 80


kkfirewall(config)# route dmz

Route already exists


I had to replace the real outside IP partly with "X" in this, because the customer does not want their IPs published.

I can also post the suggested setup for the 2 1720 routers if that helps...

Also, the DMZ uses Appletalk (and has to continue to use it). Can i use appletalk (the 1720 supports it) and still be able to communicate from the DMZ to the inside?

New Member

Re: Setting up Pix 515 with 3 interfaces and a remote location.

I know Appletalk won’t go through the PIX as it’s an IP only box. You might be able to tunnel Appletalk through GRE if you have a tunnel endpoint inside. You’re also using a network static static (inside,dmz) netmask 0 0 for all your inside hosts to appear on the DMZ with their own addresses but you have you DMZ numbered with a 10.0.1.x class C which will likely cause a problem with your network static. You might consider something completely different like 192.168.1.x for the dmz or at least 10.2.x.x. So there’s some places to start troubleshooting. Good luck.

New Member

Re: Setting up Pix 515 with 3 interfaces and a remote location.


Maybe you need as well, another static route at the pix dmz interface, to communicate with the remote dmz, otherwise you won't be able to send anything from the inside to de remote dmz, through the intermediate dmz and 1720 routers.

Something like this at the pix:

route dmz subnet_ip_addres_remote_dmz ip_address_1720_attached_to_close_dmz

Hope this help as well.


José Luis De Diego González.