topic Re: PIX statics & ACLs in Network Security https://community.cisco.com/t5/network-security/pix-statics-acls/m-p/479715#M534233 <HTML><HEAD></HEAD><BODY><P>Since this access-list is bound to the outside interface, you need the IP address that will correspond to the outside interface. Therefore, your second access-list line should be correct.</P><P>access-list IN permit tcp 205.15.25.0 0.0.0.255 host 192.1.24.21 eq www </P></BODY></HTML> Fri, 12 Aug 2005 15:12:38 GMT rsmith 2005-08-12T15:12:38Z PIX statics & ACLs https://community.cisco.com/t5/network-security/pix-statics-acls/m-p/479714#M534230 <P>Which comes first on an inbound access filter (access-group IN in interface outside): static or ACL?</P><P></P><P>For example...</P><P>Let's say I want to redirect any outside hosts trying to reach 10.7.7.21 in DMZ7 to use 192.1.24.21...</P><P> static(DMZ7,outside) 192.1.24.21 10.7.7.21 netmask 255.255.255.255</P><P></P><P>Now I want to only allow outside users on 205.15.25.0/24 to use HTTP on the redirected host DMZ7's 10.7.7.21.</P><P>Since 10.7.7.21 has been translated to 192.1.24.21 do I use...</P><P> access-list IN permit tcp 205.15.25.0 0.0.0.255 host 10.7.7.21 eq www</P><P>OR</P><P> access-list IN permit tcp 205.15.25.0 0.0.0.255 host 192.1.24.21 eq www</P><P></P><P>TIA</P> Fri, 21 Feb 2020 08:19:46 GMT https://community.cisco.com/t5/network-security/pix-statics-acls/m-p/479714#M534230 brymiller 2020-02-21T08:19:46Z Re: PIX statics & ACLs https://community.cisco.com/t5/network-security/pix-statics-acls/m-p/479715#M534233 <HTML><HEAD></HEAD><BODY><P>Since this access-list is bound to the outside interface, you need the IP address that will correspond to the outside interface. Therefore, your second access-list line should be correct.</P><P>access-list IN permit tcp 205.15.25.0 0.0.0.255 host 192.1.24.21 eq www </P></BODY></HTML> Fri, 12 Aug 2005 15:12:38 GMT https://community.cisco.com/t5/network-security/pix-statics-acls/m-p/479715#M534233 rsmith 2005-08-12T15:12:38Z