topic Re: PIX 515E question RE: https access in Network Security

PIX 515E question RE: https access

bhhouston — Fri, 21 Feb 2020 07:48:44 GMT

We have a web server in our dmz allowing http access to an application. We have installed SSL and now want to change our application access to https. I'm having a little trouble with the config. Here's the relevant config info:

access-list inbound permit tcp any host x.x.x.110 eq www

static (dmz,outside) x.x.x.110 x.x.x.110 netmask 255.255.255.255 0 0

access-group inbound in interface outside

I have added:

access-list inbound permit tcp any host x.x.x.110 eq https

My questions are: Is this sufficient to allow https access to my application? Do I need to remove the access-list . . . www command? Would I be better served by changing my new access-list command from eq https to eq 443? Is there anything else I need to add to insure access? Have I missed anything?

Thanks, Ben

Re: PIX 515E question RE: https access

paddyxdoyle — Thu, 16 Dec 2004 16:21:08 GMT

Hi,

What you have done is fine, you can remove your first rule (www) only if you want to prevent anyone from accessing your web site using HTTP.

It doesn't matter whether you use "eq 443" or "eq https" on the PIX as it will interpret either correctly.

HTH

Re: PIX 515E question RE: https access

d.kratz — Thu, 16 Dec 2004 16:23:25 GMT

Hello Ben,

You need configure the nat statement. The nat command will define for what networks firewall will route.

The command is some thing like:

nat (inside) 0 x.y.z.110 255.255.255.255 0 0

Regards,

Kratz

Re: PIX 515E question RE: https access

bhhouston — Thu, 16 Dec 2004 18:39:24 GMT

Thanks for the replys. It appears that my addition will take care of my access and I can take http access away by removing the www statement. That's just the kind of information I was looking for.

Oh, and my NAT statement was already in place so I think I'm good there.

Thanks again and if you think of anything else that would help me, feel free to add something.

Two thumbs up to the Cisco forums.

Ben