topic Re: pix inside+dmz problem in Network Security

pix inside+dmz problem

ramesh.krishnan — Fri, 21 Feb 2020 06:44:36 GMT

Hi,

I have a cisco 520 pix firewall and have the inside, outside and dmz working well. The INSIDE was addded recently and now, I want the inside and dmz zones to communicate with each other. IS this possible. If then how?

can anyone help me out with some links or their own solutions?

thanks in advance.

Ramesh

Re: pix inside+dmz problem

mhoda — Wed, 14 May 2003 18:51:23 GMT

Ramesh,

Yes, this will definitely work. For simplicity purpose lets have an example:

Inside : 10.1.1.0/24 network inside interface of pix: 10.1.1.1

dmz: 172.16.171.0/24 network dmz interface of pix: 172.16.171.1

For connection from inside to dmz:

nat (inside) 1 10.1.1.0

global (dmz) 1 interface

If you have acl appalied on inside interface, pl. make sure to allow the traffic from iunside to dmz. Also, if you have an existing nat for the outside, then you may apply the same nat to the dmz interface.

For connection from dmz to inside:

static (inside, dmz) 10.1.1.50 10.1.1.50 (lets say web server has ip 10.1.1.50)

access-list 102 permit tcp any host 10.1.1.50 permit 80

access-group dmz in

Note: if you want to allow the communication from dmz to inside, the whole network then you can define " static (inside, dmz) 10.1.1.0 10.1.1.0), in that case, you will not need the nat/global for the inside to outside communication.

I hope this helps ! Thanks,

Mynul

Re: pix inside+dmz problem

m.laporta — Thu, 15 May 2003 07:15:24 GMT

Hi Minul.

I have the problem to configure access from the whole dmz to (a subnet in) the inside and viceversa.

For dmz to inside connection, I understand from your reply that I need :

static (inside, dmz) 10.1.1.0 10.1.1.0 + access-list 102.

But what about inside to dmz connections? Do you mean that I need a simple

nat (inside) 0 access-list in-to-dmz

or that I need nothing else at all?

Thank you very much!

Michele

Re: pix inside+dmz problem

mhoda — Thu, 15 May 2003 20:43:00 GMT

Hi Michele,

Once you define static, you will not need anyting else. If you define nat (inside) 0 ACL then, this will superce static and will perform the same job. So, either of this two options will work for you. So, define either static or nat 0 ACL.

I hope its clear ! Thanks,

Mynul

Re: pix inside+dmz problem

ramesh.krishnan — Sun, 18 May 2003 11:40:41 GMT

hi Mynul,

The same worked. thanks a lot...thanks a 100 times..... 🙂

cheers,

Ramesh