topic Re: Pix multiple internet access in Network Security

Pix multiple internet access

qvoyles — Fri, 21 Feb 2020 08:51:08 GMT

Hi,

Here's my hardware layout:

I've got a Pix 515E UR w/ 6 ports @ ver7.1(2)

I've got two T1 connections to the internet.

Currently I've got the following interfaces: inside(sec level 100), outside(sec 0)(1st T1), dmz(sec 50) and T1(sec 0)(2nd T1).

The inside interface only needs access to dmz and T1.

The DMZ has an email server and I would need to restrict it to only using the outside interface to access the internet.

I've tried to do this in single context mode with no luck keeping the dmz from just access the outside interface.

Here's my question: Is this possible in single context and I'm just missing something or should I go to multiple contexts?

Thanks!

beth-martin — Thu, 27 Apr 2006 13:15:08 GMT

try this link

Fernando_Meza — Thu, 27 Apr 2006 23:24:09 GMT

Why don't you try a "trick"

Create PAT for devices on the inside network going towards DMZ and T1 ie.

nat (inside) 1

global (dmz) 1

global (T1) 1

Restrict access from inside host to the outside interface by doing PAT using a facke NONROUTABLE address

nat (inside) 1

global (outside) 1

As the NATes IP will be nonroutable on the outside interface .. the traffic will fall on a black hole

Post it if you find it helps