topic File Server in DMZ - I can ping it, but can't connect via unc pa in Network Security

File Server in DMZ - I can ping it, but can't connect via unc path

Ian Walker — Tue, 12 Mar 2019 02:00:29 GMT

host = Windows Server 2003 in DMZ ( 192.168.171.21 )

I can ping it from my INSIDE network ( INSIDE = 192.168.172.0 )

But I can't connect via UNC path

access-list dmz_access_in extended permit ip 192.168.171.21 255.255.255.0 192.168.172.0 255.255.255.0

access-list dmz_access_in extended permit udp host 192.168.171.21 192.168.172.0 255.255.255.0 eq netbios-ns

access-list dmz_access_in extended permit udp host 192.168.171.21 192.168.172.0 255.255.255.0 eq netbios-dgm

access-list dmz_access_in extended permit tcp host 192.168.171.21 192.168.172.0 255.255.255.0 eq 139

access-list dmz_access_in extended permit tcp host 192.168.171.21 192.168.172.0 255.255.255.0 eq 445

Is this even a firewall issue or a M$ issue?

Thanks,

Ian.

File Server in DMZ - I can ping it, but can't connect via unc pa

andyjames — Wed, 19 Jun 2013 15:40:51 GMT

Hello,

Looks as though you have the right ports in the acl for the DMZ, is the acl on the Inside interface permitting everything through?

Have you filtered the logs by IP address and tried to connect? Would show if anything is being blocked along the way.

File Server in DMZ - I can ping it, but can't connect via unc pa

Ian Walker — Wed, 19 Jun 2013 15:58:44 GMT

My understanding is that a stateful connection originating from the INSIDE Security level 100 will be allowed back in from DMZ security level 50 ?

On the inside interface I have only the default 1 implicit incoming rule

Source = ANY Destination = Anly less secure

Do I need acl on INSIDE interface ?

Thanks,

Ian.

File Server in DMZ - I can ping it, but can't connect via unc pa

andyjames — Wed, 19 Jun 2013 16:06:08 GMT

Hi,

Yep, if you only have the default rule on the Inside then it should allow the flow through to the DMZ and back. No need for an acl on the Inside, just wasn't sure if you had one other than the default or not.

Would try filtering the logs to see if anything is being blocked, other than that, packet tracer might flag something up.