topic Re: Help Configuring a 3 Interface PIX in Network Security

Help Configuring a 3 Interface PIX

tpopejr — Fri, 21 Feb 2020 08:19:53 GMT

I've recently setup a PIX and I know the INSIDE - OUTSIDE translation was working properly but I'm having difficulty configuring the new 'REMOTE' interface on the PIX. I've attached a (very) basic drawing of the network.

In order for the REMOTE LAN to have FULL communication (including PING) with the INSIDE LAN, what commands need to be configured?

I'm assuming the following:

For full two-way communication between INSIDE and REMOTE:

Static (inside,remote) 10.11.1.0 10.11.1.0 netmask - no translation between subnets

Access-list 101 permit ip 10.11.1.0 255.255.255.0 10.10.0.0 255.255.0.0

Access-group 101 in interface remote

I've done this and it still doesn't work. What am I forgetting?

A Million thank you's,

Tom

Re: Help Configuring a 3 Interface PIX

mehrdad — Sun, 14 Aug 2005 18:22:30 GMT

check this out pls :

static (inside,remote) 10.10.0.0 10.10.0.0 netmask 255.255.0.0

Re: Help Configuring a 3 Interface PIX

cruz-a — Sun, 14 Aug 2005 19:31:31 GMT

I think you need a nat 0 statement in addtion to what you have.

PIX(config)#nat (remote) 0 10.11.1.0 255.255.255.0 0 0

Re: Help Configuring a 3 Interface PIX

jmia — Sun, 14 Aug 2005 20:11:12 GMT

Tom,

Have a read of the following document:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008015efa9.shtml

This document gives example of configuring PIX with Mail server access on the DMZ, you can substitute the mail server for your remote LAN.

Hope this help and let me know how you get on, please rate post if it helps.

Re: Help Configuring a 3 Interface PIX

tpopejr — Tue, 16 Aug 2005 12:56:18 GMT

The article did not address my main issue. Full two-way communication between INSIDE and DMZ (or REMOTE in my example).

Additionally, do I have to list the two subnets in between the PIX and the remote network (it's across a T1 - hopping two 1760 routers)?

Thanks,

Tom

Re: Help Configuring a 3 Interface PIX

rsmith — Fri, 19 Aug 2005 22:32:23 GMT

You do not need to list the intermediate subnets, but the PIX does need to know how to get to the 10.11.1.0 network

route REMOTE 10.11.1.0 255.255.255.0 192.168.253.2

Otherwise, it will use the default route.

Re: Help Configuring a 3 Interface PIX

jackko — Mon, 22 Aug 2005 01:25:45 GMT

please post the config

Re: Help Configuring a 3 Interface PIX

arumugasamy — Mon, 22 Aug 2005 05:18:29 GMT

Scenario tested in home network lab:

access-list all permit ip any any

access-list 120 permit ip 10.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0

nat (inside) 0 access-list 120

static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0

access-group all in interface dmz

We need to configure the NAT 0

I used NAT exemption

I hope It would help ypu

swamy