topic Re: PIX Config help in Network Security

PIX Config help

jwebber — Fri, 21 Feb 2020 07:48:30 GMT

I have a web server in dmz2 (192.168.11.200). Currently the web server cannot intiate any traffic to our lan on 192.168.1.0. I need to allow this web server to initiate traffic to 192.168.1.46 on port 1801 and 1433. Not matter what I try, I cannot get it to work.

If anyone can tell me what I need to change I would appreciate it. I have attached my config. Thanks.

Jim

Re: PIX Config help

scoclayton — Tue, 14 Dec 2004 20:18:22 GMT

access-list dmz2-out permit tcp host 192.168.11.200 host 192.168.1.46 eq 1801

access-list dmz2-out permit tcp host 192.168.11.200 host 192.168.1.46 eq 1433

should do the trick. Let us know.

Scott

Re: PIX Config help

jwebber — Tue, 14 Dec 2004 20:23:16 GMT

Scott,

Thanks for the reply. I think I know where I may be having my issue. Should both those statements go before

access-list dmz2-out deny ip any 192.168.1.0 255.255.255.0

I had tried both those statement but access-list dmz2-out deny ip any 192.168.1.0 255.255.255.0 came first.

Jim

Re: PIX Config help

thisisshanky — Tue, 14 Dec 2004 20:23:25 GMT

Jim

Your ACL dmz2-out doesnt seem to have those ports 1801 and 1433 listed. Also your ACL is configured wrong. The first line denys every traffic going to 192.168.1.0 subnet.

access-list dmz2-out deny ip any 192.168.1.0 255.255.255.0 <---denys everything to 192.168.1.0

access-list dmz2-out deny ip any 192.168.10.0 255.255.255.0

access-list dmz2-out deny ip any 192.168.12.0 255.255.255.0

access-list dmz2-out permit tcp host 192.168.11.200 any eq ftp

access-list dmz2-out permit tcp host 192.168.11.200 any eq www

access-list dmz2-out permit udp host 192.168.11.200 any eq domain

access-list dmz2-out permit tcp host 192.168.11.200 any eq domain

access-list dmz2-out permit tcp host 192.168.11.200 any eq https

You should configure it as follows

access-list dmz2-out permit tcp host 192.168.11.200 any eq ftp

access-list dmz2-out permit tcp host 192.168.11.200 any eq www

access-list dmz2-out permit udp host 192.168.11.200 any eq domain

access-list dmz2-out permit tcp host 192.168.11.200 any eq domain

access-list dmz2-out permit tcp host 192.168.11.200 any eq https

access-list dmz2-out permit tcp host 192.168.11.200 any eq 1801

access-list dmz2-out permit tcp host 192.168.11.200 any eq 1433

There is an implicit deny at the end of any access-list. So you dont have to specifically deny the rest of the traffic. Just permit what is needed, PIX will take care of denying the rest.

HTH

Sankar.

Re: PIX Config help

jwebber — Tue, 14 Dec 2004 20:28:10 GMT

Sankar,

Thanks for the reply and the help. I now see what was causing me my grief.

Jim