topic Access-List for with in DMZ communication in Network Security

Access-List for with in DMZ communication

s-santhosh — Tue, 12 Mar 2019 00:03:39 GMT

Hello, I tried to depict my problem in below diagram.

I'm trying to allow communication between VLANs 333 and 444.

VLANs 333 and 444 Gateways are configured in Firewall using virtual interfaces.

Applied the access-list at IP level from source VLAN 333 host to VLAN 444 host on access-group of G0/2.333 interface

I could not ping to VLAN 444 host.

configured same same-security-traffic permit inter-interface but no luck.

What Im missing here?

Thanks in Advance!

Karsten Iwen — Wed, 03 Oct 2012 18:54:00 GMT

"same-security-traffic permit inter-interface" is only needed if both interfaces have the same security-level. But have you enables ICMP-inspection?

policy-map global_policy

class inspection_default

inspect icmp

And your switch shouldn't have an IP in the VLN444 if that traffic has to be processed by the firewall.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

s-santhosh — Wed, 03 Oct 2012 19:07:24 GMT

Thanks Karsten,

Switch IP Address is in use for ssh, but this is not the correct way of doing, but some how this is in place already.

I will try enabling ICM inspection. I have not tried it out.

lcambron — Wed, 03 Oct 2012 19:15:54 GMT

If the inspect icmp doesn't fix it, try to run a packet tracer and take captures:

packet in interface_name icmp source_IP 8 0 destination_IP

capture test interface interface_name match icmp host source_IP host destination_IP

show cap test

Let us know how it goes.

Felipe.

s-santhosh — Sat, 06 Oct 2012 09:11:14 GMT

Thanks Icambron for your reply.

Based on the packet tracer, i have re-created a ACL and it is now working,

s-santhosh — Sat, 06 Oct 2012 09:12:02 GMT

Thanks Karsten,

Inspect ICMP worked.