topic Dmz to inside in Network Security

Dmz to inside

dhengste7 — Mon, 11 Mar 2019 09:19:47 GMT

Added 4 port ethernet on a Pix 515e, ver: 6.3

So I have the following:

ip address outside 63.209.xxx.xx 255.255.255.192

ip address inside 172.16.x.x 255.255.255.0

ip address dmz 192.168.121.4 255.255.255.0

From a web server on the dmz interface I'm unable to ping inside hosts. Although from inside I can ping the dmz web server. Show icmp:

icmp permit any outside

icmp permit any inside

icmp permit any echo dmz

What am I missing. Thanks.

Re: Dmz to inside

Collin Clark — Mon, 15 Jan 2007 22:12:13 GMT

To go from a lower security interface to a higher one, you need NAT translations. For example

static (inside,dmz) 172.16.x.x 172.16.x.x netmask 255.255.255.0

You will also need an ACL.

access-list dmz_access permit icmp any any

access-group dmz_access in interface dmz

This example is NOT secure-- only allow access to what is needed.

HTH and please rate.

Re: Dmz to inside

dhengste7 — Tue, 16 Jan 2007 16:54:23 GMT

Here's what I have in place:

static (inside,dmz) 172.0.0.0 172.0.0.0 netmask 255.255.255.0 0 0

access-group dmz_access_in in interface dmz

access-list dmz_access_in line 1 permit icmp any any (hitcnt=845)

access-list dmz_access_in line 2 permit tcp host 192.168.121.34 host 172.16.x.x eq 1433 (hitcnt=0)

Goal is to be able to communicate with a sql server on the inside.

Re: Dmz to inside

acomiskey — Tue, 16 Jan 2007 16:57:59 GMT

Did you want to put 172.0.0.0/24 in your static (inside,dmz)?

Do you have a 172.0.0.0/24 network inside?

If not, it should be

static (inside,dmz) 172.0.0.0 172.0.0.0 netmask 255.0.0.0

static (inside,dmz) 172.16.x.0 172.16.x.0 netmask 255.255.255.0

Re: Dmz to inside

dhengste7 — Tue, 16 Jan 2007 19:19:41 GMT

Yes I have a 172.0.0.0/24 on the inside interface.

My issue is unable to communicate with the inside from the dmz web server. With what I posted above how would I proceed? thanks.

Re: Dmz to inside

acomiskey — Tue, 16 Jan 2007 20:26:24 GMT

But the host on the inside you want to hit on 1433 is not part of 172.0.0.0/24.

You need to add another static (inside,dmz) for the 172.16.x.0 network.

Re: Dmz to inside

dhengste7 — Wed, 24 Jan 2007 21:22:25 GMT

I have:

static (inside,dmz) tcp interface 1433 172.16.3.3 1433 netmask 255.255.255.255 0 0

Still having a problem connecting to a sql server on the inside.

Re: Dmz to inside

acomiskey — Wed, 24 Jan 2007 21:45:56 GMT

Have you tried the suggested above? I don't think you want what you just posted.

If you can watch the logs you are probably getting "No translation group found". If 172.16.3.3 is you sql server, then add

static (inside,dmz) 172.16.3.3 172.16.3.3 netmask 255.255.255.255

Post a sanitized config if you can.

Re: Dmz to inside

dhengste7 — Thu, 25 Jan 2007 18:52:13 GMT

Watching the log, but not getting the "no translation error". Attached is the config.

Re: Dmz to inside

acomiskey — Thu, 25 Jan 2007 19:39:48 GMT

Try this.

http://www.cisco.com/warp/public/110/mailserver.html

Pay close attention to the following line

static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0

You will need one except yours would be

static (inside,dmz) 172.16.3.0 172.16.3.0 netmask 255.255.255.0 0 0

This will allow anything on 172.16.3.0/24 network to communicate with dmz server and vice versa.

I also don't know what this line is supposed to do static (inside,dmz) tcp interface 1433 172.16.3.3 1433 netmask 255.255.255.255 0 0.

You may have to "clear xlate" after the command is added. Just be aware of that. Also make sure your sql is running on 1433.

Someone correct me if I'm wrong here.

Re: Dmz to inside

dhengste7 — Tue, 20 Feb 2007 19:38:23 GMT

I removed:

static (inside,dmz) 172.16.3.3 172.16.3.3 netmask 255.255.255.0 0 0

Added:

static (inside,dmz) 172.16.3.0 172.16.3.0 netmask 255.255.255.0 0 0

Right now would be happy just to ping from inside to dmz. Have the acl:

access-list dmz_access permit icmp any any

Re: Dmz to inside

acomiskey — Tue, 20 Feb 2007 19:53:46 GMT

As long as you are coming from inside 172.16.3.x you should be fine. Did you apply that acl with access-group dmz_access in interface dmz?

Re: Dmz to inside

dhengste7 — Tue, 20 Feb 2007 19:57:32 GMT

Yes, coming from 172.16.3.x and have the acl:

access-group dmz_access in interface dmz

Re: Dmz to inside

acomiskey — Tue, 20 Feb 2007 20:04:34 GMT

Did you get rid of this line

static (inside,dmz) tcp interface 1433 172.16.3.3 1433 netmask 255.255.255.255

Might as well post current config and start logging.